Add disclosure-header message for AI authorship disclosure in safe-outputs

[Copilot]

Every workflow using safe-outputs under a maintainer PAT currently needs to repeat the same AI authorship boilerplate string across all 20+ workflows. This adds a first-class disclosure-header opt-in that prepends a built-in AI authorship notice to every safe-output body (issues, comments, PRs, discussions).

Changes

• Go (SafeOutputMessagesConfig): New DisclosureHeader string field with yaml:"disclosure-header" / json:"disclosureHeader" tags. Parser handles both bool (true → sentinel "true") and custom string.
• JS (messages_header.cjs): New getDisclosureHeader() alongside getBodyHeader(). When value is "true", renders the built-in DEFAULT_DISCLOSURE_HEADER; otherwise renders the value as a template.
• 4 handlers (create_issue, add_comment, create_discussion, create_pull_request): Inject disclosure header after any threat-detection caution and before body-header.
• JSON schema (main_workflow_schema.json): disclosure-header as oneOf: [boolean, string] with explicit ordering docs.

Usage

safe-outputs:
messages:
disclosure-header: true # built-in default# ordisclosure-header: "> 🤖 Custom notice by [{workflow_name}]({run_url})."

Default text:

🤖 Automated content — generated by the Workflow workflow. The account owner did not write or review this content personally.

Body ordering (top → bottom): threat-detection caution → disclosure-header → body-header → agent content → footer.

---

Generated by 👨‍🍳 PR Sous Chef · 10.4 AIC · ⌖ 5.15 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

---

Generated by 👨‍🍳 PR Sous Chef · 8.9 AIC · ⌖ 5.99 AIC · ⊞ 4.7K · ◷
_{Comment /souschef to run again}

---

Generated by 👨‍🍳 PR Sous Chef · 6.57 AIC · ⌖ 6.74 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

---

Generated by 👨‍🍳 PR Sous Chef · 4.36 AIC · ⌖ 7.98 AIC · ⊞ 4.7K · ◷
_{Comment /souschef to run again}

---

Generated by 👨‍🍳 PR Sous Chef · 7.94 AIC · ⌖ 6.73 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

---

Generated by 👨‍🍳 PR Sous Chef · 9.71 AIC · ⌖ 6.72 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

---

Generated by 👨‍🍳 PR Sous Chef · 12.5 AIC · ⌖ 6.14 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

[github-actions]

🔍 Design Decision Gate 🏗️ is checking for design decision records on this pull request...

[Copilot]

Pull request overview

Note

Copilot couldn't run its full agentic review because no GitHub Actions runner was available. Make sure your repository has a runner available to run Copilot's review, or add a copilot-setup-steps.yml file specifying one with the runs-on attribute. See the docs for more details.

Adds an opt-in disclosure-header safe-outputs message that prepends an AI authorship notice (default or custom template) to generated issue/comment/PR/discussion bodies, reducing boilerplate across workflows.

Changes:

• Extend Go safe-outputs messages config to parse/serialize disclosure-header (bool → sentinel "true" or custom string).
• Add JavaScript getDisclosureHeader() + default built-in disclosure text, and re-export via messages.cjs.
• Inject disclosure header into multiple handlers and document the new option in the workflow JSON schema; add unit tests (Go + JS).

Show a summary per file

File	Description
pkg/workflow/safe_outputs_messages_test.go	Adds Go tests for parsing + JSON serialization of disclosure-header.
pkg/workflow/safe_outputs_messages_config.go	Implements Go parsing for disclosure-header (bool/string).
pkg/workflow/safe_outputs_config_types.go	Adds DisclosureHeader field + tags to messages config type.
pkg/parser/schemas/main_workflow_schema.json	Documents + validates disclosure-header in schema via oneOf boolean/string.
actions/setup/js/messages_header.test.cjs	Adds JS tests for getDisclosureHeader() + default template constant.
actions/setup/js/messages_header.cjs	Implements DEFAULT_DISCLOSURE_HEADER + getDisclosureHeader().
actions/setup/js/messages.cjs	Re-exports getDisclosureHeader.
actions/setup/js/create_pull_request.cjs	Injects disclosure header into PR body assembly.
actions/setup/js/create_issue.cjs	Injects disclosure header into issue body assembly.
actions/setup/js/create_discussion.cjs	Injects disclosure header into discussion body assembly.
actions/setup/js/add_comment.cjs	Injects disclosure header into comment prefix assembly.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 11/11 changed files
• Comments generated: 5
• Review effort level: Low

[pelikhan]

/matt

[github-actions]

🧠 Matt Pocock Skills Reviewer failed during the skills-based review.

[gh-aw-bot]

@copilot please run the pr-finisher skill, address unresolved review feedback, and rerun checks once the branch update settles.

Unresolved review feedback to address first:

• copilot-pull-request-reviewer review feedback remains open.

Run: https://github.com/github/gh-aw/actions/runs/29016118662

Generated by 👨‍🍳 PR Sous Chef · 10.4 AIC · ⌖ 5.15 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot please run the pr-finisher skill, address unresolved review feedback, and rerun checks once the branch update settles.

Unresolved review feedback to address first:...

Addressed the unresolved review feedback in commit 259ec46 (type-safe disclosureHeader handling, sentinel constants, schema false behavior docs, and header-ordering comment clarifications), then reran local checks (make fmt, make lint, make test-unit, make test, make recompile) and parallel validation.

[pelikhan]

@copilot use renderTemplateFile helper, see other place where templates are rendered

[Copilot]

@copilot use renderTemplateFile helper, see other place where templates are rendered

Updated in 36ff9e0: actions/setup/js/messages_header.cjs now uses the shared renderTemplateFromFile(getPromptPath(...), {}) helper for the default disclosure template path, matching the existing template rendering pattern used elsewhere.

[gh-aw-bot]

pr-sous-chef
@copilot please run the pr-finisher skill, make sure the latest maintainer feedback is fully addressed, and rerun checks once the branch is up to date.

Run: https://github.com/github/gh-aw/actions/runs/29072075004

Generated by 👨‍🍳 PR Sous Chef · 10.3 AIC · ⌖ 7.41 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

[Copilot]

pr-sous-chef
@copilot please run the pr-finisher skill, make sure the latest maintainer feedback is fully addressed, and rerun checks once the branch is up to date.
...

Completed in 7850dbc3aa.

• Branch is up to date with origin/main (merged latest main).
• Latest maintainer feedback on this PR is fully addressed (including the renderTemplateFromFile update already on head).
• Re-ran checks: make fmt, make lint, make test-unit, make test, make recompile — all passed.
• Reviewed run 29072075004: completed success with 0 failed jobs.

[gh-aw-bot]

@copilot please run the pr-finisher skill, address unresolved review comments, and rerun checks once the branch is up to date.

Unresolved review threads:

• copilot-swe-agent: Add disclosure-header message for AI authorship disclosure in safe-outputs #44497 (comment)
• copilot-swe-agent: Add disclosure-header message for AI authorship disclosure in safe-outputs #44497 (comment)
• copilot-swe-agent: Add disclosure-header message for AI authorship disclosure in safe-outputs #44497 (comment)
• copilot-swe-agent: Add disclosure-header message for AI authorship disclosure in safe-outputs #44497 (comment)
• copilot-swe-agent: Add disclosure-header message for AI authorship disclosure in safe-outputs #44497 (comment)
• copilot-swe-agent: Add disclosure-header message for AI authorship disclosure in safe-outputs #44497 (comment)
• copilot-swe-agent: Add disclosure-header message for AI authorship disclosure in safe-outputs #44497 (comment)

Generated by 👨‍🍳 PR Sous Chef · 12.5 AIC · ⌖ 6.14 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.82.8