fix: wire call_workflow into consolidated safe_outputs handler-manager path

[Copilot]

call_workflow was missing from five integration points in the consolidated safe-outputs pipeline, causing Process Safe Outputs to fail with No handler loaded for type 'call_workflow' at runtime, and workflows using only call-workflow to compile without a Process Safe Outputs step or MCP setup entirely.

Runtime (safe_output_handler_manager.cjs)

• Added call_workflow: "./call_workflow.cjs" to HANDLER_MAP so loadHandlers() requires the module when config.call_workflow is present.

Compiler config (compiler_safe_outputs_config.go)

• Added "call_workflow" entry to handlerRegistry emitting max, workflows, and workflow_files into GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG. No target-repo/target-ref fields — those belong to dispatch_workflow only.

# Before fix — call_workflow omitted even when configured
GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: '{"add_comment":{"max":1}}'

# After fix
GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: '{"add_comment":{"max":1},"call_workflow":{"max":1,"workflows":["worker-a"],"workflow_files":{"worker-a":"./.github/workflows/worker-a.lock.yml"}}}'

Compiler job gating (compiler_safe_outputs_job.go)

• Added data.SafeOutputs.CallWorkflow != nil to hasHandlerManagerTypes so a call-workflow-only workflow compiles a Process Safe Outputs step.

Safe output state reflection (safe_outputs_state.go)

• Added "CallWorkflow": "call_workflow" to safeOutputFieldMapping. This map drives reflection-based checks in hasAnySafeOutputEnabled() and hasNonBuiltinSafeOutputsEnabled(). Without this, HasSafeOutputsEnabled() returned false for call-workflow-only configs, breaking MCP server setup, Copilot engine tools, Docker configuration, MCP environment/detection, the agent prompt safe-outputs section, and applyDefaultCreateIssue() (which would incorrectly inject a default create-issue).

Prompt tools list (unified_prompt_step.go)

• Added call_workflow to the <safe-output-tools>Tools: ... prompt section alongside dispatch_workflow, so the agent is informed of call-workflow capability.

Tests

• TestAddHandlerManagerConfigEnvVar_CallWorkflow — asserts call_workflow, workflows, and workflow_files appear in the emitted JSON config
• TestCallWorkflowOnly_UsesHandlerManagerStep — asserts Process Safe Outputs is generated when call-workflow is the only configured safe-output type
• Two runtime tests in safe_output_handler_manager.test.cjs — handler invocation path and regression for the no-handler fallback

---

💬 Send tasks to Copilot coding agent from Slack and Teams to turn conversations into code. Copilot posts an update in your thread when it's finished.

[pelikhan]

@copilot find all uses of dispatch_workflow and ensure call_workflow is similarly wired

[Copilot]

Pull request overview

Fixes missing call_workflow integration in the consolidated safe-outputs handler-manager pipeline so workflows configured with only call-workflow correctly generate and run the “Process Safe Outputs” step without runtime “No handler loaded…” errors.

Changes:

• Registers call_workflow in the runtime handler manager HANDLER_MAP so loadHandlers() can load it when configured.
• Adds call_workflow to the compiler’s handler-manager config emission and to the compiler’s consolidated job gating so the handler-manager step is generated.
• Adds/extends Go + JS tests to cover emitted config and runtime processing/no-handler regression.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pkg/workflow/compiler_safe_outputs_job.go	Includes CallWorkflow in handler-manager type gating to ensure “Process Safe Outputs” is generated for call-workflow-only setups.
pkg/workflow/compiler_safe_outputs_job_test.go	Adds regression test asserting the consolidated job includes the handler-manager step/env var when only call-workflow is configured.
pkg/workflow/compiler_safe_outputs_config.go	Emits call_workflow handler config (including max, workflows, and optional workflow_files) into GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG.
pkg/workflow/compiler_safe_outputs_config_test.go	Adds tests asserting call_workflow appears in emitted JSON and that workflows / workflow_files are present.
actions/setup/js/safe_output_handler_manager.cjs	Registers call_workflow in HANDLER_MAP so the runtime can load the handler.
actions/setup/js/safe_output_handler_manager.test.cjs	Adds tests validating processMessages success path when registered and the no-handler error when missing.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

@copilot find all uses of dispatch_workflow and ensure call_workflow is similarly wired

Done in b1cf3de. Found two additional missing spots after auditing all dispatch_workflow references:

1. safe_outputs_state.go – safeOutputFieldMapping was missing "CallWorkflow": "call_workflow". This map drives hasAnySafeOutputEnabled() / hasNonBuiltinSafeOutputsEnabled() via reflection, so HasSafeOutputsEnabled() would return false for call-workflow-only configs — breaking MCP setup, Copilot engine tools, Docker configuration, prompt generation, and applyDefaultCreateIssue() (which would incorrectly inject a default create-issue).

2. unified_prompt_step.go – call_workflow was missing from the <safe-output-tools> prompt tools list (parallel to the existing dispatch_workflow entry at line 726-728).

The other dispatch_workflow occurrences (safe_outputs_config_generation.go, safe_outputs_tools_filtering.go, safe_outputs_permissions.go, safe_outputs_tools_loader.cjs) already had matching call_workflow handling.