Function generateSafeOutputsSetup

pkg/workflow/mcp_setup_generator.go:260–329

(c *Compiler, yaml *strings.Builder, safeOutputConfig string, workflowData *WorkflowData)

}

func generateSafeOutputsSetup(c *Compiler, yaml *strings.Builder, safeOutputConfig string, workflowData *WorkflowData) {
	if !HasSafeOutputsEnabled(workflowData.SafeOutputs) {
		return
	}
	yaml.WriteString("      - name: Generate Safe Outputs Config\n")
	sanitizedConfig, envKeys, envValues := buildSafeOutputsConfigRuntimeData(safeOutputConfig)
	if len(envKeys) > 0 {
		yaml.WriteString("        env:\n")
		writeStepEnvVars(yaml, envKeys, envValues)
	}
	yaml.WriteString("        run: |\n")
	yaml.WriteString("          mkdir -p \"${RUNNER_TEMP}/gh-aw/safeoutputs\"\n")
	yaml.WriteString("          mkdir -p /tmp/gh-aw/safeoutputs\n")
	yaml.WriteString("          mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs\n")
	if workflowData.SafeOutputs != nil && workflowData.SafeOutputs.UploadArtifact != nil {
		yaml.WriteString("          mkdir -p \"${RUNNER_TEMP}/gh-aw/safeoutputs/upload-artifacts\"\n")
	}
	if workflowData.SafeOutputs != nil && workflowData.SafeOutputs.UploadAssets != nil {
		yaml.WriteString("          mkdir -p \"${RUNNER_TEMP}/gh-aw/safeoutputs/assets\"\n")
	}

	delimiter := GenerateHeredocDelimiterFromContent("SAFE_OUTPUTS_CONFIG", sanitizedConfig)
	if safeOutputConfig != "" {
		yaml.WriteString("          cat > \"${RUNNER_TEMP}/gh-aw/safeoutputs/config.json\" << '" + delimiter + "'\n")
		yaml.WriteString("          " + sanitizedConfig + "\n")
		yaml.WriteString("          " + delimiter + "\n")
	}

	toolsMetaJSON, err := generateToolsMetaJSON(workflowData, c.markdownPath)
	if err != nil {
		mcpSetupGeneratorLog.Printf("Error generating tools meta JSON: %v", err)
		toolsMetaJSON = `{"description_suffixes":{},"repo_params":{},"dynamic_tools":[]}`
	}

	var enabledTypes []string
	if safeOutputConfig != "" {
		var configMap map[string]any
		if err := json.Unmarshal([]byte(safeOutputConfig), &configMap); err == nil {
			for typeName := range configMap {
				enabledTypes = append(enabledTypes, typeName)
			}
		}
	}
	// Propagate mentions config to the collection pass so that allowed @-mentions
	// (e.g. "@copilot") are not backtick-escaped before publish-side handlers run.
	var mentionsBlock map[string]any
	if workflowData.SafeOutputs != nil && workflowData.SafeOutputs.Mentions != nil {
		mentionsBlock = buildMentionsHandlerConfig(workflowData.SafeOutputs.Mentions)
	}
	validationConfigJSON, err := GetValidationConfigJSON(enabledTypes, mentionsBlock)
	if err != nil {
		mcpSetupGeneratorLog.Printf("CRITICAL: Error generating validation config JSON: %v - validation will not work correctly", err)
		validationConfigJSON = "{}"
	}

	yaml.WriteString("      - name: Generate Safe Outputs Tools\n")
	yaml.WriteString("        env:\n")
	yaml.WriteString("          GH_AW_TOOLS_META_JSON: |\n")