Function buildCodePushFailureContext

actions/setup/js/handle_agent_failure.cjs:774–989

* Build a context string describing code-push failures for inclusion in failure issue/comment bodies. * Manifest file protection refusals are separated from other push failures to give them a dedicated * section with clearer remediation instructions. * @param {string} codePushFailureErrors - Newl

(codePushFailureErrors, pullRequest = null, runUrl = "")

 * @returns {string} Formatted context string, or empty string if no failures
 */
function buildCodePushFailureContext(codePushFailureErrors, pullRequest = null, runUrl = "") {
  if (!codePushFailureErrors) {
    return "";
  }

  // Split errors into protected-file protection refusals, patch size errors, patch apply failures, and other push failures
  const manifestErrors = [];
  const patchSizeErrors = [];
  const patchApplyErrors = [];
  const otherErrors = [];
  const errorLines = codePushFailureErrors.split("\n").filter(line => line.trim());
  for (const errorLine of errorLines) {
    const colonIndex = errorLine.indexOf(":");
    if (colonIndex !== -1) {
      const type = errorLine.substring(0, colonIndex);
      const error = errorLine.substring(colonIndex + 1);
      if (error.includes("manifest files") || error.includes("protected files")) {
        manifestErrors.push({ type, error });
      } else if (error.includes("Patch size") && error.includes("exceeds")) {
        patchSizeErrors.push({ type, error });
      } else if (error.includes("Failed to apply patch")) {
        patchApplyErrors.push({ type, error });
      } else {
        otherErrors.push({ type, error });
      }
    }
  }

  let context = "";

  // Protected file protection section — shown before generic failures
  if (manifestErrors.length > 0) {
    context +=
      "\n**🛡️ Protected Files**: The code push was refused because the patch modifies protected files (package manifests, agent instruction files, or repository security configuration). " +
      "This protection guards against unintended supply chain changes.\n";
    if (pullRequest) {
      context += `\n**Target Pull Request:** [#${pullRequest.number}](${pullRequest.html_url})\n`;
    }
    context += "\n**Blocked Operations:**\n";
    for (const { type, error } of manifestErrors) {
      context += `- \`${type}\`: ${error}\n`;
    }
    // Build a dynamic YAML snippet listing only the safe output types that were actually blocked
    const typeToYamlKey = {
      create_pull_request: "create-pull-request",
      push_to_pull_request_branch: "push-to-pull-request-branch",
    };
    const blockedTypes = [...new Set(manifestErrors.map(e => e.type))];
    let yamlSnippet = "```yaml\nsafe-outputs:\n";
    for (const type of blockedTypes) {
      const yamlKey = typeToYamlKey[type] || type.replace(/_/g, "-");
      yamlSnippet += `  ${yamlKey}:\n    protected-files: fallback-to-issue\n`;
    }
    yamlSnippet += "```\n";
    context += "\n<details>\n<summary>⚙️ Configure <code>protected-files: fallback-to-issue</code></summary>\n\n";
    context += yamlSnippet;
    context += "</details>\n";
  }