Add environment variable manifest for safe output job types

[Copilot]

Different safe output job types require different environment variables, but these requirements were undocumented and unvalidated, leading to runtime failures when variables were missing.

Changes

Created pkg/workflow/safe_output_env_manifest.go

• Defines required/optional environment variables for 11 safe output job types
• Provides validation API: GetRequiredEnvVarsForJobType(), ValidateSafeOutputJobEnvVars()
• Documents common variables shared across all job types (e.g., GH_AW_WORKFLOW_NAME, GITHUB_TOKEN)
• Includes default values where applicable (e.g., GH_AW_PR_DRAFT: "true")

Created pkg/workflow/safe_output_env_manifest_test.go

• 18 comprehensive unit tests covering all manifest functionality
• Validates required/optional variable detection
• Tests error handling for unknown job types

Updated docs/src/content/docs/reference/safe-outputs.md

• Added "Environment Variables Reference" section
• Documents all environment variables by job type with required/optional distinction

Usage

// Validate configuration
required, _ := workflow.GetRequiredEnvVarsForJobType("create_pull_request")
// Returns: ["GH_AW_WORKFLOW_NAME", "GITHUB_TOKEN", "GH_AW_WORKFLOW_ID", ...]

missing := workflow.ValidateSafeOutputJobEnvVars("create_pull_request", providedVars)
if len(missing) > 0 {
    return fmt.Errorf("missing required variables: %v", missing)
}

Foundation for future compile-time validation to catch configuration errors early.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[plan] Create environment variable manifest for safe output job types</issue_title>
<issue_description>## Objective

Create a comprehensive manifest documenting which environment variables are required by each safe output job type, enabling automated validation and preventing configuration errors.

Context

Different safe output job types have different environment variable requirements, but these are not documented or validated systematically. This leads to runtime failures when required variables are missing.

Approach

1. Audit all safe output job scripts in actions/setup-safe-outputs/src/
2. For each job type, identify required environment variables:
   • create_pull_request
   • add_comment
   • add_labels
   • create_issue
   • create_discussion
   • missing_tool
   • noop
   • etc.
3. Create a manifest file (JSON or YAML) mapping job types to required variables
4. Update workflow compiler to use this manifest when generating safe_outputs jobs

Files to Create/Modify

• Create: pkg/workflow/safe_output_env_manifest.json (or similar)
• Update: Workflow compiler code to read and use the manifest
• Update: actions/setup-safe-outputs/ scripts to reference manifest

Example Manifest Structure

{
  "create_pull_request": {
    "required": ["GH_AW_WORKFLOW_ID", "GITHUB_TOKEN"],
    "optional": ["GH_AW_PR_BASE_BRANCH"]
  },
  "add_comment": {
    "required": ["GITHUB_TOKEN"],
    "optional": []
  }
}

Acceptance Criteria

• Manifest file created with all safe output job types
• All required environment variables documented for each type
• Workflow compiler reads manifest during compilation
• Manifest is validated in unit tests
• Documentation updated with environment variable requirements

Testing

make test  # Ensure manifest validation works
./gh-aw compile (test-workflow.md)  # Verify compiler uses manifest

Priority

Medium - Prevents future configuration issues
Related to #7023

AI generated by Plan Command for discussion #7018

Comments on the Issue (you are @copilot in this section)

• Fixes [plan] Create environment variable manifest for safe output job types #7025

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.