Fix safe output handler to gracefully ignore custom safe output job types (#20114)

Copilot · web-flow · commit 984fc7a650a8 · 2026-03-08T13:20:02.000-07:00
diff --git a/actions/setup/js/safe_output_handler_manager.cjs b/actions/setup/js/safe_output_handler_manager.cjs
@@ -20,6 +20,7 @@ const { getIssuesToAssignCopilot } = require("./create_issue.cjs");
 const { createReviewBuffer } = require("./pr_review_buffer.cjs");
 const { sanitizeContent } = require("./sanitize_content.cjs");
 const { createManifestLogger, ensureManifestExists, extractCreatedItemFromResult } = require("./safe_output_manifest.cjs");
+const { loadCustomSafeOutputJobTypes } = require("./safe_output_helpers.cjs");
 
 /**
  * Handler map configuration
@@ -244,6 +245,13 @@ async function processMessages(messageHandlers, messages, onItemCreated = null)
   /** @type {Array<{type: string, error: string}>} */
   const codePushFailures = [];
 
+  // Load custom safe output job types (from GH_AW_SAFE_OUTPUT_JOBS env var)
+  // These are processed by dedicated custom job steps, not by this handler manager
+  const customJobTypes = loadCustomSafeOutputJobTypes();
+  if (customJobTypes.size > 0) {
+    core.info(`Loaded ${customJobTypes.size} custom safe output job type(s): ${[...customJobTypes].join(", ")}`);
+  }
+
   core.info(`Processing ${messages.length} message(s) in order of appearance...`);
 
   // Process messages in order of appearance
@@ -287,6 +295,20 @@ async function processMessages(messageHandlers, messages, onItemCreated = null)
         continue;
       }
 
+      // Check if this message type is handled by a custom safe output job
+      if (customJobTypes.has(messageType)) {
+        // Silently skip - this is handled by a custom safe output job step
+        core.debug(`Message ${i + 1} (${messageType}) will be handled by custom safe output job`);
+        results.push({
+          type: messageType,
+          messageIndex: i,
+          success: false,
+          skipped: true,
+          reason: "Handled by custom safe output job",
+        });
+        continue;
+      }
+
       // Unknown message type - warn the user
       core.warning(
         `⚠️ No handler loaded for message type '${messageType}' (message ${i + 1}/${messages.length}). The message will be skipped. This may happen if the safe output type is not configured in the workflow's safe-outputs section.`
@@ -899,6 +921,7 @@ async function main() {
     const cancelledCount = processingResult.results.filter(r => r.cancelled).length;
     const deferredCount = processingResult.results.filter(r => r.deferred).length;
     const skippedStandaloneResults = processingResult.results.filter(r => r.skipped && r.reason === "Handled by standalone step");
+    const skippedCustomJobResults = processingResult.results.filter(r => r.skipped && r.reason === "Handled by custom safe output job");
     const skippedNoHandlerResults = processingResult.results.filter(r => !r.success && !r.skipped && r.error?.includes("No handler loaded"));
 
     core.info(`\n=== Processing Summary ===`);
@@ -916,6 +939,11 @@ async function main() {
       const standaloneTypes = [...new Set(skippedStandaloneResults.map(r => r.type))];
       core.info(`  Types: ${standaloneTypes.join(", ")}`);
     }
+    if (skippedCustomJobResults.length > 0) {
+      core.info(`Skipped (custom safe output job): ${skippedCustomJobResults.length}`);
+      const customJobTypesList = [...new Set(skippedCustomJobResults.map(r => r.type))];
+      core.info(`  Types: ${customJobTypesList.join(", ")}`);
+    }
     if (skippedNoHandlerResults.length > 0) {
       core.warning(`Skipped (no handler): ${skippedNoHandlerResults.length}`);
       const noHandlerTypes = [...new Set(skippedNoHandlerResults.map(r => r.type))];
diff --git a/actions/setup/js/safe_output_handler_manager.test.cjs b/actions/setup/js/safe_output_handler_manager.test.cjs
@@ -20,6 +20,7 @@ describe("Safe Output Handler Manager", () => {
     // Clean up environment variables
     delete process.env.GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG;
     delete process.env.GH_AW_TRACKER_LABEL;
+    delete process.env.GH_AW_SAFE_OUTPUT_JOBS;
   });
 
   describe("loadConfig", () => {
@@ -218,6 +219,91 @@ describe("Safe Output Handler Manager", () => {
       expect(core.warning).toHaveBeenCalledWith(expect.stringContaining("No handler loaded for message type 'unknown_type'"));
     });
 
+    it("should skip custom safe output job types gracefully without error", async () => {
+      // Set up custom safe output jobs (e.g., send_slack_message handled by a dedicated job step)
+      process.env.GH_AW_SAFE_OUTPUT_JOBS = JSON.stringify({
+        send_slack_message: "message_url",
+      });
+
+      const messages = [
+        { type: "create_issue", title: "Issue" },
+        { type: "send_slack_message", channel: "#alerts", text: "Hello" },
+      ];
+
+      const mockHandler = vi.fn().mockResolvedValue({ success: true });
+
+      // Only create_issue handler is available; send_slack_message is a custom job
+      const handlers = new Map([["create_issue", mockHandler]]);
+
+      const result = await processMessages(handlers, messages);
+
+      expect(result.success).toBe(true);
+      expect(result.results).toHaveLength(2);
+
+      // First message should succeed
+      expect(result.results[0].success).toBe(true);
+      expect(result.results[0].type).toBe("create_issue");
+
+      // Custom job message should be skipped gracefully (not an error)
+      expect(result.results[1].success).toBe(false);
+      expect(result.results[1].type).toBe("send_slack_message");
+      expect(result.results[1].skipped).toBe(true);
+      expect(result.results[1].reason).toBe("Handled by custom safe output job");
+      expect(result.results[1].error).toBeUndefined();
+
+      // Should NOT have logged a "No handler loaded" warning
+      expect(core.warning).not.toHaveBeenCalledWith(expect.stringContaining("No handler loaded for message type 'send_slack_message'"));
+    });
+
+    it("should skip multiple custom safe output job types gracefully", async () => {
+      process.env.GH_AW_SAFE_OUTPUT_JOBS = JSON.stringify({
+        send_slack_message: "message_url",
+        notion_add_comment: "comment_url",
+      });
+
+      const messages = [
+        { type: "send_slack_message", channel: "#alerts", text: "Hello" },
+        { type: "notion_add_comment", page_id: "abc123", text: "Note" },
+        { type: "create_issue", title: "Issue" },
+      ];
+
+      const mockHandler = vi.fn().mockResolvedValue({ success: true });
+      const handlers = new Map([["create_issue", mockHandler]]);
+
+      const result = await processMessages(handlers, messages);
+
+      expect(result.success).toBe(true);
+      expect(result.results).toHaveLength(3);
+
+      // Custom job types should be skipped gracefully
+      expect(result.results[0].skipped).toBe(true);
+      expect(result.results[0].reason).toBe("Handled by custom safe output job");
+      expect(result.results[1].skipped).toBe(true);
+      expect(result.results[1].reason).toBe("Handled by custom safe output job");
+
+      // create_issue should succeed
+      expect(result.results[2].success).toBe(true);
+    });
+
+    it("should still warn for unknown types not in custom job types", async () => {
+      process.env.GH_AW_SAFE_OUTPUT_JOBS = JSON.stringify({
+        send_slack_message: "message_url",
+      });
+
+      const messages = [{ type: "completely_unknown_type", data: "test" }];
+
+      const handlers = new Map();
+
+      const result = await processMessages(handlers, messages);
+
+      expect(result.success).toBe(true);
+      expect(result.results[0].error).toContain("No handler loaded");
+      expect(result.results[0].skipped).toBeUndefined();
+
+      // Should have logged a warning for truly unknown types
+      expect(core.warning).toHaveBeenCalledWith(expect.stringContaining("No handler loaded for message type 'completely_unknown_type'"));
+    });
+
     it("should handle handler errors gracefully", async () => {
       const messages = [{ type: "create_issue", title: "Issue" }];
 
diff --git a/pkg/workflow/guard_policy_experimental_warning_test.go b/pkg/workflow/guard_policy_experimental_warning_test.go
@@ -29,7 +29,7 @@ engine: copilot
 tools:
   github:
     repos: all
-    min-integrity: reader
+    min-integrity: unapproved
 permissions:
   contents: read
 ---
@@ -77,7 +77,7 @@ tools:
   github:
     repos:
       - owner/repo
-    min-integrity: writer
+    min-integrity: approved
 permissions:
   contents: read
 ---
