add-labels safe output fails on pull requests with invalid UpdatePullRequestInput mutation

[lpcox]

Summary

With workflows compiled by gh-aw v0.86.0, the add_labels safe-output handler fails when targeting a pull request through the issue-intent path. The agent jobs and substantive smoke checks pass, but the safe_outputs job ends in partial_success because label application sends an invalid GraphQL mutation.

This single regression caused 5 of the 10 failing checks observed on github/gh-aw-firewall#6988.

Error

Adding 1 labels to pull request #6988 in github/gh-aw-firewall via GraphQL intent mutation

InputObject 'UpdatePullRequestInput' doesn't accept argument 'labels'
Variable $labels is declared by anonymous mutation but not used

UpdatePullRequestInput does not accept a labels field. Labels should be applied through the appropriate Labelable mutation/API.

Reproductions

All five runs use workflows compiled with gh-aw v0.86.0 and github/gh-aw-actions/setup@19356acbcf6b0677aa06bacc1b9894fe883ae751. In each case, the safe_outputs job failed specifically while applying a PR label through the GraphQL intent mutation.

1. Build Test Suite — build-test label failed:
   https://github.com/github/gh-aw-firewall/actions/runs/31193148741/job/92916400717?pr=6988
2. Smoke Copilot — agent passed; comment succeeded; smoke-copilot label failed:
   https://github.com/github/gh-aw-firewall/actions/runs/31193148729/job/92915507081?pr=6988
3. Smoke Copilot BYOK AOAI (Entra) — smoke-copilot-byok-aoai-entra label failed:
   https://github.com/github/gh-aw-firewall/actions/runs/31193148553/job/92916091985?pr=6988
4. Smoke Copilot Network Isolation — both egress checks passed; comment succeeded; smoke-copilot-network-isolation label failed:
   https://github.com/github/gh-aw-firewall/actions/runs/31193148779/job/92915690538?pr=6988
5. Smoke Docker Sbx — smoke-docker-sbx label failed:
   https://github.com/github/gh-aw-firewall/actions/runs/31193148603/job/92916965312?pr=6988

Expected behavior

The configured allowed label is added to the triggering pull request and the safe_outputs job succeeds.

Actual behavior

The comment safe output succeeds where present, but add_labels fails as non-retryable. The handler reports partial success and exits the job unsuccessfully.

Related issue

This appears related to, or a regression from, #50894. That issue reported a different PR-label intent error on v0.85.4 and is now closed.

Workaround

Configuring add-labels with issue-intent: false reportedly bypasses the broken intent mutation path.

[dsyme]

This follow-on currently blocks us from resolving a production workflow failure in github/github-automation. We hit the predecessor v0.85.4 bug tracked in #50894 here:

https://github.com/github/github-automation/actions/runs/31167013012/job/92833840460

That run targeted PR github/github#444971. Its comment safe output succeeded, but add_labels routed the PR node ID through updateIssue and failed. #50910 corrects that node-type mismatch, but this issue shows the replacement updatePullRequest(input: ... labels: ...) mutation is also invalid. Consequently there is currently no working issue-intent path for adding labels to PRs across these versions.

We need the PR path to use a supported Labelable mutation/API while preserving the rationale/confidence/suggest metadata semantics, or to degrade safely to the REST label endpoint. Until then, our practical workaround is issue-intent: false, which drops the intent metadata.