[Safe Outputs Conformance] IMP-004: 13 safe-outputs config properties missing from JSON schema

[github-actions]

Conformance Check Failure

Check ID: IMP-004
Severity: HIGH
Category: Implementation (Safe Output Config Schema Coverage)

Problem Description

The conformance checker (scripts/check-safe-outputs-conformance.sh, check_safe_output_config_schema_coverage) compares YAML-tagged fields on Go safe-output config structs in pkg/workflow/*.go against the JSON Schema at pkg/parser/schemas/main_workflow_schema.json. It found 13 config properties that exist and are actively used in Go structs/handlers but are absent from the JSON schema under safe-outputs. This is a recurring finding (also reported yesterday as #53317 with an identical property list — still unresolved).

Because these properties aren't declared in the schema, workflow authors setting them get no editor autocomplete, no type checking, and no schema-based documentation for these fields (the schema does not set additionalProperties: false for the affected sections, so this is a tooling/DX gap rather than a hard validation failure — but it is still a spec conformance violation per IMP-004/REQ-002).

Affected Components

• safe-outputs.add-comment.allows-comment-ids — pkg/workflow/add_comment.go:21
• safe-outputs.add-comment.hide-older-comments-match — pkg/workflow/add_comment.go:23
• safe-outputs.assign-milestone.auto_create — pkg/workflow/assign_milestone.go:15
• safe-outputs.call-workflow.workflow_files — pkg/workflow/call_workflow.go:16 (compiler-populated, not user-authored)
• safe-outputs.comment-memory (entire section missing from schema) — pkg/workflow/comment_memory.go, pkg/workflow/safe_outputs_config_types.go:50
• safe-outputs.create-issue.require-temporary-id — pkg/workflow/create_issue.go:16
• safe-outputs.create-pull-request.require-temporary-id — pkg/workflow/create_pull_request.go:48
• safe-outputs.dispatch-workflow.aw_context_workflows — pkg/workflow/dispatch_workflow.go:16 (compiler-populated, not user-authored)
• safe-outputs.dispatch-workflow.workflow_files — pkg/workflow/dispatch_workflow.go:15 (compiler-populated, not user-authored)
• safe-outputs.push-to-pull-request-branch.base-branch — pkg/workflow/push_to_pull_request_branch.go:28
• safe-outputs.threat-detection.engine-config — pkg/workflow/threat_detection_config.go:13
• safe-outputs.threat-detection.environment — pkg/workflow/threat_detection_config.go
• safe-outputs.threat-detection.model — pkg/workflow/threat_detection_config.go

Schema file: pkg/parser/schemas/main_workflow_schema.json

🔍 Current vs Expected Behavior

Current Behavior

pkg/parser/schemas/main_workflow_schema.json defines safe-outputs.<type> sub-schemas that omit the 10 user-facing fields above, and omits the comment-memory key entirely from safe-outputs.properties. Workflow frontmatter using these fields compiles fine (Go structs already parse them via unmarshalConfig/extractCommentMemoryConfig), but schema-based validation/tooling (editor autocomplete, ajv/JSON-schema linting, docs generation from schema) has no knowledge of them.

Three of the flagged fields (call-workflow.workflow_files, dispatch-workflow.workflow_files, dispatch-workflow.aw_context_workflows) are compiler-populated internal fields ("populated at compile time" per their Go comments) rather than user-authored YAML — remediation should decide whether these need read-only schema documentation or an explicit exclusion in the checker, distinct from the 10 clearly user-facing fields.

Expected Behavior

Per REQ-002 (Safe Output Type Completeness) and IMP-004, every user-authored safe-output config field exposed via a struct's yaml tag MUST have a corresponding property entry in main_workflow_schema.json so that schema validation and editor tooling stay in sync with the Go implementation.

Remediation Steps

This task can be assigned to a Copilot coding agent with the following steps:

1. Open pkg/parser/schemas/main_workflow_schema.json and locate the safe-outputs property definitions for: add-comment, assign-milestone, create-issue, create-pull-request, push-to-pull-request-branch, and threat-detection.
2. Add the missing user-facing property definitions listed in "Affected Components" above, matching the Go type and semantics documented in each struct's comment (e.g. boolean for auto_create/require-temporary-id, array of string for allows-comment-ids/hide-older-comments-match, string for base-branch/model, object for engine-config).
3. Add a comment-memory property to safe-outputs.properties matching the fields in CommentMemoryConfig (pkg/workflow/comment_memory.go).
4. For the 3 compiler-populated fields (call-workflow.workflow_files, dispatch-workflow.workflow_files, dispatch-workflow.aw_context_workflows), decide and document whether they belong in the user-facing schema at all; if intentionally excluded, add them to an explicit allowlist in scripts/check-safe-outputs-conformance.sh's IMP-004 check rather than leaving them silently missing.
5. Run bash scripts/check-safe-outputs-conformance.sh and confirm IMP-004 passes.
6. Run the existing schema test suite (e.g. go test ./pkg/parser/... and any JSON-schema validation tests) to confirm no regressions.

Verification

After remediation, verify the fix by running:

bash scripts/check-safe-outputs-conformance.sh

The check IMP-004 should pass without errors (All safe output config properties are declared in the schema).

References

• Safe Outputs Specification: docs/src/content/docs/specs/safe-outputs-specification.md
• Conformance Checker: scripts/check-safe-outputs-conformance.sh (IMP-004, check_safe_output_config_schema_coverage)
• Prior report: [Safe Outputs Conformance] IMP-004: 13 safe-outputs config properties missing from JSON schema #53317 (2026-08-17, same finding, unresolved)
• Run ID: 32104247993
• Date: 2026-08-18

Generated by ✅ Daily Safe Outputs Conformance Checker · agent · 73.7 AIC · ⌖ 7.63 AIC · ⊞ 7K · ◷

• expires on Aug 18, 2026, 9:54 PM UTC-08:00