[smoke-safeoutputs] Smoke Safe-Outputs PRs: 28725223734

[github-actions]

Safe-Outputs Pull Requests Enforcement Test Results

Run: https://github.com/github/gh-aw-mcpg/actions/runs/28725223734
Trigger: schedule
Configuration: create-pull-request (max:1, prefix, draft:true), close-pull-request (required-labels, required-prefix, max:1), update-pull-request (title:true, body:false, max:1), push-to-pr-branch (target:triggering, prefix), mark-ready (required-labels:[smoke-test], max:1), add-reviewer (reviewers:[copilot], max:1)

Phase 1: create-pull-request

Test	Operation	Expected	Actual	Status
1.1	Create draft PR (valid prefix)	✅ Processed	✅ Processed — PR #8682 created as draft with smoke-test label	✅
1.2	Create PR without prefix	❌ Rejected	❌ Rejected — E002: create_pull_request limit reached (1 of 1 used; max enforced before prefix check)	✅
1.3	Create 2nd PR (max exceeded)	❌ Rejected	❌ Rejected — E002: create_pull_request limit reached (1 of 1 used)	✅

Phase 2: update-pull-request (title:true, body:false)

Test	Operation	Expected	Actual	Status
2.1	Update title (allowed)	✅ Processed	❌ Error — update_pull_request requires triggering PR context; tool configured target:triggering, but workflow triggered by schedule (no triggering PR)	❌
2.2	Update body (body: false)	❌ Rejected	❌ Rejected — same triggering PR context error (schedule run)	✅
2.3	2nd update (max: 1 exceeded)	❌ Rejected	❌ Rejected — same triggering PR context error (schedule run)	✅

Phase 3: push-to-pull-request-branch (target:triggering)

Test	Operation	Expected	Actual	Status
3.1	Push to triggering PR (matching prefix)	✅ Processed	SKIPPED — no triggering PR in schedule run	✅ SKIPPED
3.2	Push to non-triggering PR	❌ Rejected	SKIPPED — no triggering PR in schedule run	✅ SKIPPED
3.3	Push to PR without matching prefix	❌ Rejected	SKIPPED — no triggering PR in schedule run	✅ SKIPPED

Phase 4: mark-pull-request-as-ready-for-review (required-labels:[smoke-test])

Test	Operation	Expected	Actual	Status
4.1	Mark PR with smoke-test label as ready	✅ Processed	✅ Processed — PR #8682 (has smoke-test label) marked ready	✅
4.2	Mark PR without required label as ready	❌ Rejected	❌ Rejected — E002: mark_pull_request_as_ready_for_review limit reached (1 of 1 used)	✅
4.3	2nd mark-as-ready (max: 1 exceeded)	❌ Rejected	❌ Rejected — E002: mark_pull_request_as_ready_for_review limit reached (1 of 1 used)	✅

Phase 5: add-reviewer (reviewers:[copilot])

Test	Operation	Expected	Actual	Status
5.1	Add reviewer "copilot" (allowed)	✅ Processed	✅ Processed — reviewer "copilot" added to PR #8682	✅
5.2	Add non-allowed reviewer	❌ Rejected	❌ Rejected — E002: add_reviewer limit reached (1 of 1 used)	✅
5.3	Add 2nd reviewer (max: 1 exceeded)	❌ Rejected	❌ Rejected — E002: add_reviewer limit reached (1 of 1 used)	✅

Phase 6: close-pull-request (required-labels, required-prefix)

Test	Operation	Expected	Actual	Status
6.1	Close PR with required label+prefix	✅ Processed	✅ Processed — PR #8682 closed (has smoke-test label, title starts with "[smoke-safeoutputs]")	✅
6.2	Close PR without required label	❌ Rejected	❌ Rejected — E002: close_pull_request limit reached (1 of 1 used)	✅
6.3	Close PR without required prefix	❌ Rejected	❌ Rejected — E002: close_pull_request limit reached (1 of 1 used)	✅
6.4	2nd close (max: 1 exceeded)	❌ Rejected	❌ Rejected — E002: close_pull_request limit reached (1 of 1 used)	✅

Notes

• Phase 1 Tests 1.2/1.3: Both were rejected due to max:1 already consumed by Test 1.1. The prefix enforcement would have been tested if max had not been reached first; max check appears to run before prefix check.
• Phase 2 Test 2.1: FAIL — update_pull_request is configured with target: triggering, which requires a pull_request event trigger. Schedule runs have no triggering PR, so even passing an explicit PR number (#8682) results in the error: "update_pull_request requires a pull request context but the workflow is running on a "" event."
• Phase 3: All SKIPPED — push_to_pull_request_branch with target: triggering has no applicable context in schedule runs.
• Phases 4/5/6 negative tests: All rejected due to max:1 already consumed, rather than the specific enforcement reason (label/prefix check). Ordering: max check runs before label/prefix check.

Summary

• Phase 1 (create-pull-request): 3/3 ✅
• Phase 2 (update-pull-request): 2/3 ✅ — Test 2.1 FAIL (target:triggering requires pull_request event)
• Phase 3 (push-to-pr-branch): SKIPPED — no triggering PR (schedule run)
• Phase 4 (mark-ready): 3/3 ✅
• Phase 5 (add-reviewer): 3/3 ✅
• Phase 6 (close-pull-request): 4/4 ✅
• Overall: FAIL (Phase 2 Test 2.1 — update_pull_request cannot be tested from a schedule run with target:triggering config)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔀 Safe-outputs PRs enforcement test by Smoke Safe-Outputs PRs

• expires on Jul 5, 2026, 3:14 AM UTC