feat: add call-workflow safe output for workflow_call chaining

[Copilot]

Adds a call-workflow safe output type enabling orchestrator/dispatcher patterns within workflow_call chains — without API calls, without extra tokens, preserving billing attribution and github.actor.

Unlike dispatch-workflow (runtime API), call-workflow is a compile-time fan-out: the compiler reads each allowed worker's workflow_call.inputs, generates typed per-worker MCP tools, and emits conditional uses: jobs. At runtime, only the worker whose name the agent selected executes.

Frontmatter

safe-outputs:
call-workflow:
workflows:
- spring-boot-bugfix
- frontend-dep-upgrademax: 1

Compiled output (simplified)

safe_outputs:
outputs:
call_workflow_name: ${{ steps.process_safe_outputs.outputs.call_workflow_name }}call_workflow_payload: ${{ steps.process_safe_outputs.outputs.call_workflow_payload }}call-spring-boot-bugfix:
needs: [safe_outputs]if: needs.safe_outputs.outputs.call_workflow_name == 'spring-boot-bugfix'uses: ./.github/workflows/spring-boot-bugfix.lock.ymlsecrets: inheritwith:
payload: ${{ needs.safe_outputs.outputs.call_workflow_payload }}

Worker inputs are forwarded as a single JSON payload string (same envelope pattern as dispatch-workflow), avoiding GitHub's 50 inputs+secrets+outputs limit per workflow_call.

Changes

• call_workflow.go — CallWorkflowConfig struct; parseCallWorkflowConfig() supporting array and map formats; max defaults to 1, capped at 50
• call_workflow_validation.go — compile-time validation: each workflow must exist, declare workflow_call, and not be a self-reference; handles .md same-batch targets
• safe_outputs_call_workflow.go — populateCallWorkflowFiles() resolves .lock.yml/.yml/.md priority; generateCallWorkflowTool() builds typed MCP tools from workflow_call.inputs (string, number, boolean, choice with enum)
• compiler_safe_output_jobs.go — buildCallWorkflowJobs() emits one conditional uses: job per worker; all added to conclusion job's needs
• compiler_safe_outputs_job.go — adds call_workflow_name / call_workflow_payload to safe_outputs job outputs when configured
• call_workflow.cjs — runtime handler: validates against allowlist, serialises inputs to JSON, sets step outputs — no GitHub API calls
• safe_outputs_tools_loader.cjs — registers _call_workflow_name tool routing alongside existing _workflow_name dispatch pattern
• Schema, imports, config generation, MCP setup — wired consistently with dispatch-workflow
• call_workflow_compilation_test.go — 16 end-to-end compilation tests covering array/map formats, typed worker inputs, cross-repo workflow_call gateway trigger, conclusion job dependencies, underscore→hyphen job naming, worker discovery across directories, and all three validation failure paths (missing trigger, self-reference, worker not found)
• docs/reference/safe-outputs.md — new TOC entry and full reference section with configuration options, worker input declaration, compiled output example, comparison table vs dispatch-workflow, and security notes
• docs/patterns/orchestration.md — expanded to cover both call-workflow and dispatch-workflow as orchestration mechanisms, with guidance on choosing between the two
• smoke-call-workflow.md — mini smoke test orchestrator using codex engine with gpt-5.1-codex-mini model, triggering on PR label water or workflow_dispatch; calls smoke-workflow-call via call-workflow to validate end-to-end fan-out

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[pelikhan]

@copilot add tests that generate various AW markdown file configuration and test the compilation process.

[pelikhan]

@copilot add documentation using the technical-doc-writer subagent

[Copilot]

@copilot add tests that generate various AW markdown file configuration and test the compilation process.

Added call_workflow_compilation_test.go (commit 07ba441) with 16 end-to-end tests that write AW markdown configurations, run CompileWorkflow(), and assert on the generated .lock.yml content.

Scenarios covered:

• Array format (call-workflow: [worker-a, worker-b]) and map format (call-workflow: { workflows: [...], max: 1 })
• Single worker / multiple workers / three workers
• Worker with typed inputs (choice, boolean, string, number) → MCP tool generation
• Gateway triggered via workflow_call (cross-repo pattern)
• call-workflow alongside add-comment
• safe_outputs job declares call_workflow_name / call_workflow_payload outputs
• Conclusion job depends on all call-* worker jobs
• Worker name with underscores → hyphenated job name
• Worker file found in .github/workflows from a gateway in .github/aw
• Worker as .md source only (same-batch compilation)
• Validation failures: missing workflow_call trigger, self-reference, worker not found

[Copilot]

@copilot add documentation using the technical-doc-writer subagent

Added documentation in commit b102256:

• docs/src/content/docs/reference/safe-outputs.md: New TOC entry and full reference section for call-workflow covering configuration options, worker input declaration (with typed inputs example), compiled output structure, validation rules, and a comparison table vs dispatch-workflow.

• docs/src/content/docs/patterns/orchestration.md: Updated to cover both call-workflow and dispatch-workflow as orchestration mechanisms, with guidance on when to choose each.

[pelikhan]

@copilot add a mini smoke-call-workflow agentic workflow orchestrator that tells the agent to call another workflow (find one with workflow_call). Uses gpt-5.1-codex-mini , codex and triggers on water.

[Copilot]

@copilot add a mini smoke-call-workflow agentic workflow orchestrator that tells the agent to call another workflow (find one with workflow_call). Uses gpt-5.1-codex-mini , codex and...

Added smoke-call-workflow.md in commit 7a3bf9c:

• Engine: codex with gpt-5.1-codex-mini model
• Triggers: workflow_dispatch + PR label water
• call-workflow configured to call smoke-workflow-call (the existing reusable worker that validates checkout in a workflow_call context)
• The compiled lock file emits a call-smoke-workflow-call conditional uses: job — no API call, full actor attribution

[Copilot]

Pull request overview

Adds a new call-workflow safe output type to enable compile-time, allowlisted fan-out to reusable workflow_call worker workflows (typed MCP tools + conditional uses: jobs), plus docs and smoke coverage.

Changes:

• Introduces CallWorkflowConfig, parsing, compile-time validation, and dynamic MCP tool generation from worker workflow_call.inputs.
• Emits conditional call-* reusable-workflow jobs wired off safe_outputs outputs (call_workflow_name / call_workflow_payload) and adds them to conclusion dependencies.
• Adds runtime safe-output handler (call_workflow.cjs), tool loader routing, schema/docs updates, and extensive compilation/validation tests + smoke workflow.

Reviewed changes

Copilot reviewed 25 out of 25 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pkg/workflow/safe_outputs_tools_filtering.go	Generates dynamic MCP tools for call-workflow workers (extracts workflow_call.inputs).
pkg/workflow/safe_outputs_config_generation.go	Serializes call_workflow settings into generated safe-outputs config JSON.
pkg/workflow/safe_outputs_config.go	Parses call-workflow from frontmatter into compiler config.
pkg/workflow/safe_outputs_call_workflow.go	Populates worker file mappings and generates typed MCP tools from workflow_call.inputs.
pkg/workflow/mcp_setup_generator.go	Ensures call-workflow file mappings are populated before config/tool generation.
pkg/workflow/imports.go	Enables call-workflow safe-output detection and import merging.
pkg/workflow/data/action_pins.json	Updates/removes some action pin entries (versions/aliases).
pkg/workflow/compiler_types.go	Adds CallWorkflow to SafeOutputsConfig.
pkg/workflow/compiler_safe_outputs_job.go	Exposes call_workflow_name / call_workflow_payload as safe_outputs job outputs when configured.
pkg/workflow/compiler_safe_outputs_core.go	Includes call-workflow in base safe-output config collection.
pkg/workflow/compiler_safe_output_jobs.go	Builds conditional call-* reusable workflow jobs and wires them into the job graph.
pkg/workflow/compiler.go	Runs compile-time call-workflow validation during compilation.
pkg/workflow/call_workflow_validation.go	Validates workers exist, declare workflow_call, and are not self-references; extracts workflow_call.inputs.
pkg/workflow/call_workflow.go	Defines CallWorkflowConfig and frontmatter parsing logic.
pkg/parser/schemas/main_workflow_schema.json	Adds schema support for safe-outputs.call-workflow (array/map forms, max bounds).
docs/src/content/docs/reference/safe-outputs.md	Documents call-workflow configuration, compiled output, and security notes.
docs/src/content/docs/patterns/orchestration.md	Expands orchestration pattern docs to cover call-workflow vs dispatch-workflow.
actions/setup/js/call_workflow.cjs	Implements runtime handler to validate allowlist, serialize inputs, and set step outputs (no API calls).
actions/setup/js/call_workflow.test.cjs	Adds unit tests for the call_workflow handler behavior.
actions/setup/js/safe_outputs_tools_loader.cjs	Routes dynamically generated call_workflow tools to the call_workflow handler.
.github/workflows/smoke-call-workflow.md	Adds a smoke orchestrator workflow that must call a worker via call-workflow.
.github/workflows/smoke-call-workflow.lock.yml	Compiled lockfile showing the new conditional call-* job wiring.
.github/workflows/mcp-inspector.lock.yml	Updates pinned astral-sh/setup-uv SHA.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[pelikhan]

@copilot review suggestions / comments and apply.

[Copilot]

@copilot review suggestions / comments and apply.

Applied the open review suggestion in commit 0f0847f:

• Duplicate workflow names (compiler_safe_output_jobs.go thread): added an early check in validateCallWorkflow that returns a clear error naming the duplicate entry and its two indices before any job generation is attempted. Added TestCallWorkflowCompile_ValidationFails_DuplicateWorkflow to cover this path.

The two resolved threads (docs wording fix and call_workflow.cjs fail-closed) were already addressed in the previous commit.