Add Azure DevOps work-item safe outputs

[Copilot]

Adds Azure DevOps work-item operations to the safe-output pipeline using the tool names defined by ado-aw.

Changes

• Safe-output tools

  • Adds create-work-item, update-work-item, comment-on-work-item, assign-work-item, link-work-items, and upload-workitem-attachment.
  • Extends frontmatter parsing, schemas, validation, limits, and handler registration.

• Azure DevOps integration

  • Executes trusted REST operations through actions/github-script.
  • Authenticates with SYSTEM_ACCESSTOKEN or AZURE_DEVOPS_EXT_PAT.
  • Supports temporary IDs for same-run work-item references.

• Policy enforcement

  • Restricts mutations by work-item ID or area path.
  • Enforces configurable fields, tags, assignees, link types, and attachment constraints.
  • Rejects untrusted organization URLs, reserved identities, unsafe paths, symlinks, and pipeline command sequences.

• Artifact handling

  • Stages attachments through the existing safe-output artifact channel.
  • Records Azure DevOps work items and metadata in the safe-output manifest.

safe-outputs:
  create-work-item:
    work-item-type: Task
    area-path: MyProject\Platform
  update-work-item:
    target: MyProject\Platform
    title: true
    status: true

---

Run: https://github.com/github/gh-aw/actions/runs/33581675739

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 14.5 AIC · ⌖ 8.74 AIC · ⊞ 8.9K · ◷
_{Comment /souschef to run again}

---

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 26.8 AIC · ⌖ 8.7 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

---

pr-sous-chef run: https://github.com/github/gh-aw/actions/runs/33588850668

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 20.2 AIC · ⌖ 8.61 AIC · ⊞ 9K · ◷
_{Comment /souschef to run again}

---

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 47.2 AIC · ⌖ 8.73 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

[pelikhan]

@copilot review the plan and continue implementation where it was not finished.

[pelikhan]

@copilot mark all these safe outputs as experimental

[pelikhan]

@copilot ensure appropriate level of logging. Run custom linters for extra code quality.

[Copilot]

@copilot mark all these safe outputs as experimental

Marked all six Azure DevOps safe outputs experimental in compiler warnings, schemas, tool descriptions, documentation, and the changeset, with focused warning tests in commit 3ebdd17.

[pelikhan]

@copilot Mark, update all safe-outputs names and prepend ado_ as a prefix so that they read ADO, create-issue, ADO, update-issue, and so forth.

[Copilot]

@copilot ensure appropriate level of logging. Run custom linters for extra code quality.

Added debug-level Azure API lifecycle logs, standardized staged preview logging, and removed work-item titles and attachment paths from logs in c15fc12. Custom Go linters, custom ESLint, impacted tests, review, CodeQL applicability check, and secret scanning completed.

[Copilot]

@copilot Mark, update all safe-outputs names and prepend ado_ as a prefix so that they read ADO, create-issue, ADO, update-issue, and so forth.

Prefixed all Azure DevOps safe-output names in 59f0c00: frontmatter keys now use ado- and public/persisted tool names use ado_. Runtime routing, schemas, docs, errors, and tests were updated consistently.

[Copilot]

@copilot fix https://github.com/github/gh-aw/actions/runs/33584033261/job/100105345440#step:4:1

The failure was caused by upstream commit e8150b9 (merged via main), which switched daily-caveman-optimizer.md and semantic-function-refactor.md from claude-sonnet-4.6 to claude-sonnet-5 without updating the two dependent tests. Fixed both test expectations in cdca3b0; make test-impacted-go now passes.

[gh-aw-bot]

⚠️ This is an automated status report. Do not assign this issue to a Copilot agent.

Counter	Value
processed	10
skipped_checks_running	3
skipped_last_comment_from_sous_chef	6
skipped_cooldown	0
zero_diff_stalled	0
nudged	1
branch_update_attempts	1
formatter_pushes	0
approved_workflow_runs	0
merge_main_scheduled	0
resolved_review_threads	0
dismissed_reviews	0

Nudged PRs

• Add Azure DevOps work-item safe outputs #57796 — Add Azure DevOps work-item safe outputs

Skipped details

• Add first-class Jira safe outputs #57814 — checks running/in progress recently
• Bump astro from 7.2.4 to 7.2.9 in /docs #57666 — latest comment already from sous-chef with @copilot
• Add native Linear Safe Outputs #57816 — latest comment already from sous-chef with @copilot
• [compiler-threat-spec] Spec sync: document CTR-001 status-function bypass guard #57831 — checks running/in progress recently
• Bump mermaid from 11.17.0 to 11.17.2 in /docs #57667 — latest comment already from sous-chef with @copilot
• Bump sharp from 0.35.3 to 0.35.4 in /docs #57670 — latest comment already from sous-chef with @copilot
• Bump @astrojs/starlight from 0.41.7 to 0.41.10 in /docs #57668 — latest comment already from sous-chef with @copilot
• Bump charm.land/bubbles/v2 from 2.2.0 to 2.2.1 #57669 — latest comment already from sous-chef with @copilot
• Bump @types/node from 26.2.0 to 26.4.0 in /actions/setup/js #57665 — latest comment already from sous-chef with @copilot

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 26.8 AIC · ⌖ 8.7 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

[gh-aw-bot]

@copilot
Please review the current PR state, address the outstanding review feedback and CI follow-up, refresh the branch if needed, and run the pr-finisher skill before handing back to maintainers.

• Outstanding requested changes remain on the PR review from PR Code Quality Reviewer and a Copilot review with recommended fixes.
• Recent current-head workflow runs were created for the latest SHA; please verify their results and fix any remaining blockers.
• Branch refresh was requested from this run: https://github.com/github/gh-aw/actions/runs/33588850668

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 20.2 AIC · ⌖ 8.61 AIC · ⊞ 9K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot
Please review the current PR state, address the outstanding review feedback and CI follow-up, refresh the branch if needed, and run the pr-finisher skill before handing back to maintainers....

Ran the pr-finisher pass: branch is already even with main (merge-base matches origin/main HEAD), make fmt/make lint/make test-unit/make recompile all pass locally with no diffs. All 9 review threads already have substantive replies with fixes from earlier commits (59f0c00, f1cfcdc); no new unaddressed feedback exists. I don't have thread-resolution access in this session, so the threads remain open pending a maintainer resolving them. mergeable_state: blocked appears to be due to pending review approval rather than a code issue — no CI checks have posted status yet for this HEAD (5fd6a1e). Ready for human review/approval and CI re-trigger.

[gh-aw-bot]

@copilot
Please review the current PR state, resolve the remaining requested review feedback, confirm CI on the latest head, and run the pr-finisher skill before handing back to maintainers.

• Outstanding review feedback remains from PR Code Quality Reviewer and Copilot review on contract/schema consistency and JSON Patch behavior.
• Branch refresh was requested from this run: https://github.com/github/gh-aw/actions/runs/33592651304

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 47.2 AIC · ⌖ 8.73 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

[pelikhan]

@copilot fix https://github.com/github/gh-aw/actions/runs/33588629193/job/100130840776

[Copilot]

@copilot
Please review the current PR state, resolve the remaining requested review feedback, confirm CI on the latest head, and run the pr-finisher skill before handing back to maintainers.

• Outst...

Investigated CI on the current head and found a real regression: registerTool in mcp_server_core.cjs was storing the raw, un-normalized tool name in .name, breaking dash/case normalization (failing JS Tests shard 3/4). Fixed in 48a8c45 by keeping the normalized name in .name and tracking the original name separately for collision detection. Also corrected a stale test using id instead of work_item_id for ado_comment_on_work_item/ado_assign_work_item to match the real tool contract. Re-verified the target schema concern from PR Code Quality Reviewer — all six Azure DevOps outputs already reference the shared azure_devops_work_item_target def (integer, "*", ID list, or area-path string), so that item is already resolved. Full make test-js (13799 tests), make lint, make fmt, make recompile, and go build ./... all pass on the pushed head.

[pelikhan]

@copilot resolve the merge conflicts on this branch.

[Copilot]

@copilot fix https://github.com/github/gh-aw/actions/runs/33588629193/job/100130840776

That run (5fd6a1e) predates the fix — already resolved in 48a8c45, which corrected the registerTool regression in mcp_server_core.cjs causing the JS Tests (shard 3/4) failure. Verified the fix is present on the current head and make test-js passes locally.

[gh-aw-bot]

@copilot please take another pass on this PR, refresh the branch if needed, and run the pr-finisher skill.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 7.99 AIC · ⌖ 8.68 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}