Skip to content

fix(safeoutputs): generalize submit_pull_request_review identifier prohibition - #36544

Closed
pelikhan with Copilot wants to merge 3 commits into
mainfrom
copilot/fix-pull-request-review-warning
Closed

fix(safeoutputs): generalize submit_pull_request_review identifier prohibition#36544
pelikhan with Copilot wants to merge 3 commits into
mainfrom
copilot/fix-pull-request-review-warning

Conversation

CopilotAI commented Jun 2, 2026

Copy link
Copy Markdown
Contributor

Agents continued passing stray PR-targeting fields to submit_pull_request_review after the previous fix (#35579) because the warning named only pull_request_number — agents routed around it to item_number and other aliases instead.

Changes

  • pkg/workflow/js/safe_outputs_tools.json + actions/setup/js/safe_outputs_tools.json: Rewrites the submit_pull_request_review description to:
    • Front-load a blanket prohibition enumerating all known identifier aliases: pull_request_number, item_number, pr_number, issue_number
    • Explicitly call out that sibling tools create_pull_request_review_comment and reply_to_pull_request_review_commentdo accept pull_request_number — directly addressing the parity assumption that drives the mistake
    • Retain all existing body/event requirements and inline-comment guidance

Before:

…This tool auto-targets the pull request that triggered the workflow — do NOT pass pull_request_number (unlike create_pull_request_review_comment…

After:

…This tool ALWAYS auto-targets the pull request that triggered the workflow and accepts NO targeting parameter — do not pass pull_request_number, item_number, pr_number, or issue_number; any such field is silently stripped. Unlike sibling tools create_pull_request_review_comment and reply_to_pull_request_review_comment (which DO accept pull_request_number), this tool does not accept any PR identifier.…

Both copies are updated in the same commit so TestSafeOutputsToolsJSONInSync continues to pass.

CopilotAIand others added 2 commits June 2, 2026 22:36
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
…o all identifier fields
Lead with the prohibition and list all forbidden targeting parameters
(pull_request_number, item_number, pr_number, issue_number). Explicitly
contrast with sibling tools that DO accept pull_request_number. Retain
all existing REQUIRED-body and inline-comment guidance.
Propagate identical description to actions/setup/js/safe_outputs_tools.json
so TestSafeOutputsToolsJSONInSync continues to pass.
Fixes #36001 (or whatever the issue number is)
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
CopilotAI changed the title [WIP] Fix insufficient warning for pull request reviewfix(safeoutputs): generalize submit_pull_request_review identifier prohibitionJun 2, 2026
CopilotAI requested a review from pelikhanJune 2, 2026 22:39
@pelikhanpelikhan closed this Jun 2, 2026
@github-actions
github-actionsBot deleted the copilot/fix-pull-request-review-warning branch June 10, 2026 03:00
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[safeoutputs] submit_pull_request_review: live pull_request_number warning is insufficient — agents now substitute item_number

2 participants

@pelikhan