fix: cross-repo dispatch-workflow uses caller's GITHUB_REF instead of target repo's ref

[Copilot]

In workflow_call relay scenarios, dispatch-workflow was dispatching with the caller'sGITHUB_REF as the target ref — a ref meaningless on the target repository. The compiler already correctly injects target-repo for cross-repo relay, but there was no equivalent injection for the dispatch ref, and GITHUB_REF being set prevented the getDefaultBranchRef() fallback from ever running.

Changes

Runtime (actions/setup/js/dispatch_workflow.cjs)

• Added config["target-ref"] as the highest priority in ref resolution, checked before GITHUB_HEAD_REF/GITHUB_REF, so compiler-injected refs always win for cross-repo dispatch.

Compiler (pkg/workflow/compiler_safe_outputs_config.go)

• Extended the workflow_call injection block to also inject target-ref: ${{ needs.activation.outputs.target_ref }} alongside the existing target-repo injection.
• Added safeOutputsWithDispatchTargetRef helper (mirrors safeOutputsWithDispatchTargetRepo).
• Added target-ref to the dispatch_workflow handler config builder.

Config struct (pkg/workflow/dispatch_workflow.go)

• Added TargetRef string (yaml:"target-ref") to DispatchWorkflowConfig, with explicit parsing from the config map (enabling manual override in frontmatter as well).

JSON Schema (pkg/parser/schemas/main_workflow_schema.json)

• Added target-repo (previously missing despite additionalProperties: false) and target-ref to the dispatch-workflow object schema with descriptive documentation.

Specification (docs/src/content/docs/reference/safe-outputs-specification.md)

• Added target-ref to the dispatch_workflow Configuration Parameters.
• Added a note explaining workflow_call relay auto-injection of both target-repo and target-ref.

New ref resolution precedence in dispatch_workflow.cjs:

if(config["target-ref"]){ref=config["target-ref"];// cross-repo relay: compiler-injected}elseif(process.env.GITHUB_HEAD_REF){ref=`refs/heads/${process.env.GITHUB_HEAD_REF}`;// PR context}elseif(process.env.GITHUB_REF||context.ref){ref=process.env.GITHUB_REF||context.ref;// push/workflow_dispatch}else{ref=awaitgetDefaultBranchRef();// last resort}

Three new test cases cover: target-ref taking precedence over GITHUB_REF, same-repo dispatch still using GITHUB_REF, and target-ref taking precedence over GITHUB_HEAD_REF in PR context.

---

💬 Send tasks to Copilot coding agent from Slack and Teams to turn conversations into code. Copilot posts an update in your thread when it's finished.

[pelikhan]

@copilot update json schema and spec

[github-actions]

Hey @Copilot 👋 — great work on the dispatch-workflow cross-repo ref fix! Correctly routing the target ref for workflow_call relay scenarios is a subtle but important correctness fix, and the implementation is clean.

The PR is well-structured, focused, and comes with thorough test coverage. All three new test cases (target-ref over GITHUB_REF, same-repo dispatch unchanged, target-ref over GITHUB_HEAD_REF) cover the key edge cases well. The description clearly explains the root cause, the ref-resolution precedence change, and which files were touched — exactly the level of detail maintainers need.

Checklist summary:

Check	Result
On-topic	✅ yes
Follows process	✅ yes (Copilot agent + core team assignee)
Focused	✅ yes
New dependencies	✅ no
Has tests	✅ yes (3 new cases in dispatch_workflow.test.cjs)
Has description	✅ yes
Lines changed	112

Verdict: 🟢 Aligned — looks ready for maintainer review.

Generated by Contribution Check · ◷

[Copilot]

@copilot update json schema and spec

Done in 297a650:

• pkg/parser/schemas/main_workflow_schema.json: Added target-repo (which was missing despite additionalProperties: false) and target-ref to the dispatch-workflow object schema.
• docs/src/content/docs/reference/safe-outputs-specification.md: Added target-ref to the Configuration Parameters section and a note explaining the workflow_call relay auto-injection behaviour.

[Copilot]

Pull request overview

Fixes cross-repo dispatch-workflow in workflow_call relay scenarios by ensuring the dispatched workflow uses a ref that exists in the target repository (not the caller’s GITHUB_REF).

Changes:

• Runtime: add config["target-ref"] as highest-priority ref source during dispatch ref resolution.
• Compiler: inject target-ref for workflow_call relays and include it in the handler-manager config payload.
• Docs/schema/tests: document target-ref, extend JSON schema, and add runtime tests covering precedence.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
actions/setup/js/dispatch_workflow.cjs	Prefers target-ref over PR/push refs when dispatching.
actions/setup/js/dispatch_workflow.test.cjs	Adds tests validating new ref precedence behavior.
pkg/workflow/compiler_safe_outputs_config.go	Emits target-ref in handler config and injects it for workflow_call relays.
pkg/workflow/dispatch_workflow.go	Adds TargetRef to config and parses target-ref from frontmatter.
pkg/parser/schemas/main_workflow_schema.json	Adds target-repo/target-ref to the dispatch-workflow schema definition.
docs/src/content/docs/reference/safe-outputs-specification.md	Documents target-ref and auto-injection behavior for relay flows.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.