samples mode: create_pull_request fails with ERR_SYSTEM merge-base for siderepo workflows

[dsyme]

Summary

For a workflow that targets a side repository via target-repo: and uses create-pull-request with samples:, the deterministic samples-mode replay fails when the MCP create_pull_request handler tries to derive a patch against the side repo's origin/main.

The agent job does checkout the side repo at $GITHUB_WORKSPACE (so the older "Repository '…' not found in workspace" error from #37545 is gone), and apply_samples.preStagePatch successfully creates the branch and commits the sample patch on top. But the handler immediately fails with:

Pinned SHA <sha> failed to generate patch: ERR_SYSTEM: No remote refs available for merge-base calculation

Result: outputs.jsonl is never written, the safe-outputs step reports Found 0 message(s) in agent output, and the workflow appears to do nothing.

Repro

test-copilot-siderepo-create-pull-request.md:

---
on:
  workflow_dispatch:

permissions: read-all

engine: 
  id: copilot

tools:
  github:
    # The GitHub tools must be authorized to read across-repo 
    github-token: ${{ secrets.TEMP_USER_PAT }}

checkout:
  - repository: githubnext/gh-aw-side-repo
    token: ${{ secrets.TEMP_USER_PAT }}
    fetch: ["*"]      # fetch all open PR refs after checkout
    fetch-depth: 0               # fetch full history to ensure we can see all commits and PR details

safe-outputs:
  create-pull-request:
    title-prefix: "[copilot-test-single-pr] "
    labels: [copilot, automation, bot]
    target-repo: 'githubnext/gh-aw-side-repo'
    allowed-repos: ['githubnext/gh-aw-side-repo']
    github-token: ${{ secrets.TEMP_USER_PAT }}
    samples:
      - title: "Multi-commit test from Copilot"
        body: "This pull request was created by Copilot in the side repository to test multi-commit functionality."
        branch: "gh-aw-sample-copilot-siderepo-multi-commit"
        patch: |
          diff --git a/README-test.md b/README-test.md
          new file mode 100644
          --- /dev/null
          +++ b/README-test.md
          @@ -0,0 +1,3 @@
          +# Test Project (Side Repo)
          +
          +This is a test project created by Copilot in the side repository.
---

# Test Copilot Create Pull Request (Side Repo)

This test workflow specifically tests multi-commit functionality in create-pull-request in the side repository.

**IMPORTANT: Create multiple separate commits for this test case**

1. **First commit**: Create a file "README-test.md" with content:
   ```markdown
   # Test Project
   
   This is a test project created by Copilot to test multi-commit pull requests.
   
   Created at: {{ current timestamp }}
   ```

2. **Second commit**: Create a JavaScript script "test-script.js" with:
   ```javascript
   #!/usr/bin/env node
   function hello() {
       console.log("Hello from Copilot multi-commit test!");
   }
   
   if (require.main === module) {
       hello();
   }
   ```

3. **Third commit**: Create a configuration file "config.json" with:
   ```json
   {
       "test": true,
       "engine": "copilot",
       "purpose": "multi-commit-test",
       "repository": "githubnext/gh-aw-side-repo",
       "timestamp": "{{ current timestamp }}"
   }
   ```

Create a pull request in the repository githubnext/gh-aw-side-repo with title "[copilot-test] Multi-Commit PR Test" targeting the main branch.

Make sure all three commits are separate and properly attributed. Include a summary of all changes in the PR description.

Full failing run: https://github.com/githubnext/gh-aw-test/actions/runs/27139019229

Replay step trace:

[safeoutputs] recv: {"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"create_pull_request","arguments":{...,"branch":"gh-aw-sample-copilot-siderepo-multi-commit"}}}
[safeoutputs] send: {"jsonrpc":"2.0","id":2,"result":{"content":[{"type":"text","text":"{\"result\":\"error\",\"error\":\"Pinned SHA f37867483b41ca64c54a9a36ad733b21f67b3d45 failed to generate patch: ERR_SYSTEM: No remote refs available for merge-base calculation\",\"details\":\"No commits were found to create a pull request. Make sure you have committed your changes using git add and git commit before calling create_pull_request.\"}"}],"isError":false}}

apply_samples reports sample[0] (tool=create_pull_request) ok because the JSON-RPC call returned a result (it inspects isError, not the embedded result.error), so the failure propagates as a silent zero-output run.

Hypothesis

The handler's merge-base calculation expects origin/<baseBranch> to be available locally. For same-repo runs the workflow's own actions/checkout populates that; for the side-repo checkout it apparently does not. The handler — or the setup step — needs to either:

1. Run git fetch origin <baseBranch> against the side repo before invoking the MCP server in samples mode, or
2. Pass an explicit base SHA into the handler so the merge-base is local.

Same-repo case works

The matching same-repo workflow test-copilot-create-pull-request with the same sample shape passes. The differentiator is only the target-repo: / cross-repo checkout layout.

Secondary observation

The MCP server returns the failure inside result.content[].text with result: "error" and isError: false. apply_samples.cjs only treats result.isError === true as a failure, so this error is reported as a success ("sample[0] (tool=create_pull_request) ok") even though no output was emitted. That makes diagnosis much harder than necessary.

[dsyme]

This also reproduces for same-repo (non-target-repo) create-pull-request workflows — not just siderepo ones — when the test workflow is run from a branch that was shallow-fetched and has no merge-base with origin/main.

Context: in githubnext/gh-aw-test we now run the matrix from a dedicated, force-pushed e2e/<ref>-samples-<bool> branch (branch isolation for parallel safety). gh-aw's lock checkout shallow-fetches that branch (--depth=1) and separately shallow-fetches origin/main, so the two fragments share no common commit.

test-copilot-create-pull-request (plain same-repo, no target-repo:), run 27755612845, agent job:

[safeoutputs] Generating patch for create_pull_request with branch: gh-aw-sample-copilot-multi-commit
[debug] git show-ref --verify --quiet refs/remotes/origin/main   → exit 1
[debug] git fetch origin -- main:refs/remotes/origin/main        → ok
[debug] git merge-base -- origin/main 48a0c28…                   → exit 1
[safeoutputs] Patch generation failed: Pinned SHA 48a0c28… failed to generate patch:
  ERR_SYSTEM: Git command failed with status 1

Same end result as described here: outputs.jsonl is never written and the safe-outputs step reports nothing to process. (And because of #40059, the run still concludes success.)

Suggestion: when origin/main is shallow / has no merge-base with the pinned SHA, fall back to fetching enough history to compute a base (or treat the branch tip as the base) rather than failing patch generation. That would fix both the siderepo case and the same-repo shallow-branch case.