[safe-output-integrator] Add missing safe-output type fixtures and Go test coverage (11 types)

pkg/cli/workflows/test-copilot-concurrency-group.md

@@ -0,0 +1,24 @@
+---
+on:
+  workflow_dispatch:
+permissions:
+  contents: read
+  issues: read
+engine: copilot
+safe-outputs:
+  noop:
+    max: 1
+  concurrency-group: test-safe-outputs-${{ github.ref }}
+timeout-minutes: 5
+---
+
+# Test Copilot Concurrency Group
+
+Test the `safe-outputs.concurrency-group` configuration which sets a GitHub
+Actions concurrency group for the safe_outputs job (cancel-in-progress is
+always false for safe_outputs).
+
+Use `noop` to confirm the configuration:
+- message: "safe-outputs concurrency group is configured"
+
+Output as JSONL using the `noop` tool.

pkg/cli/workflows/test-copilot-failure-issue-repo.md

@@ -0,0 +1,24 @@
+---
+on:
+  workflow_dispatch:
+permissions:
+  contents: read
+  issues: write
+engine: copilot
+safe-outputs:
+  create-issue:
+    max: 1
+  failure-issue-repo: github/gh-aw
+timeout-minutes: 5
+---
+
+# Test Copilot Failure Issue Repo
+
+Test the `failure-issue-repo` safe-outputs configuration which redirects
+agent failure issues to a specific repository (format: "owner/repo").
+
+Create an issue summarising the failure-issue-repo configuration:
+- title: "Failure Issue Repo Test"
+- body: "This workflow validates that failure-issue-repo is set to 'github/gh-aw'. Any agent failures will create tracking issues in that repository."
+
+Output as JSONL using the `create_issue` tool.

pkg/cli/workflows/test-copilot-group-reports.md

@@ -0,0 +1,24 @@
+---
+on:
+  workflow_dispatch:
+permissions:
+  contents: read
+  issues: write
+engine: copilot
+safe-outputs:
+  create-issue:
+    max: 1
+  group-reports: true
+timeout-minutes: 5
+---
+
+# Test Copilot Group Reports
+
+Test the `group-reports` safe-outputs configuration which, when true, creates
+a parent "Failed runs" issue to group agent failure reports (default: false).
+
+Create an issue summarising the group-reports feature:
+- title: "Group Reports Test"
+- body: "This workflow validates that group-reports is enabled. When agent failures occur, they are grouped under a parent tracking issue."
+
+Output as JSONL using the `create_issue` tool.

pkg/cli/workflows/test-copilot-max-bot-mentions.md

@@ -0,0 +1,24 @@
+---
+on:
+  workflow_dispatch:
+permissions:
+  contents: read
+  issues: write
+engine: copilot
+safe-outputs:
+  add-comment:
+    max: 1
+  max-bot-mentions: "5"
+timeout-minutes: 5
+---
+
+# Test Copilot Max Bot Mentions
+
+Test the `max-bot-mentions` safe-outputs configuration which limits the maximum
+number of bot trigger references (e.g. `fixes #123`) allowed before filtering
+(default: 10). Supports integer or GitHub Actions expression.
+
+Add a comment summarising the max-bot-mentions policy:
+- message: "This workflow has max-bot-mentions set to 5. References beyond this threshold are filtered to prevent runaway bot loops."
+
+Output as JSONL using the `add_comment` tool.

pkg/cli/workflows/test-copilot-max-patch-files.md

@@ -0,0 +1,23 @@
+---
+on:
+  workflow_dispatch:
+permissions:
+  contents: write
+  pull-requests: write
+engine: copilot
+safe-outputs:
+  create-pull-request:
+    max: 1
+  max-patch-files: 50
+timeout-minutes: 5
+---
+
+# Test Copilot Max Patch Files
+
+Test the `max-patch-files` safe-outputs configuration which limits the maximum
+number of unique files allowed per `create-pull-request` patch (default: 100).
+
+Create a pull request with a single file change and a body that notes the
+max-patch-files limit is set to 50.
+
+Output as JSONL using the `create_pull_request` tool.

pkg/cli/workflows/test-copilot-mentions.md

@@ -0,0 +1,31 @@
+---
+on:
+  workflow_dispatch:
+permissions:
+  contents: read
+  issues: write
+engine: copilot
+safe-outputs:
+  add-comment:
+    max: 1
+  mentions:
+    enabled: true
+    allowed-collaborators: true
+    allow-context: true
+    allowed:
+      - copilot-bot
+timeout-minutes: 5
+---
+
+# Test Copilot Mentions Config
+
+Test the `mentions` safe-outputs configuration which controls @mention filtering
+for all comment-producing safe output handlers.
+
+Add a comment to this issue summarising the mentions policy:
+- mentions are enabled
+- repository collaborators are allowed
+- context-based mentions are allowed
+- explicitly allowed user: copilot-bot
+
+Output as JSONL using the `add_comment` tool.

pkg/cli/workflows/test-copilot-report-failure-as-issue.md

@@ -0,0 +1,25 @@
+---
+on:
+  workflow_dispatch:
+permissions:
+  contents: read
+  issues: write
+engine: copilot
+safe-outputs:
+  noop:
+    max: 1
+  report-failure-as-issue: false
+timeout-minutes: 5
+---
+
+# Test Copilot Report Failure As Issue
+
+Test the `report-failure-as-issue` safe-outputs configuration which controls
+whether workflow failures are automatically reported as GitHub issues.
+
+Setting `report-failure-as-issue: false` disables automatic failure issue creation.
+
+Use `noop` to confirm the configuration:
+- message: "report-failure-as-issue is disabled for this workflow"
+
+Output as JSONL using the `noop` tool.

pkg/cli/workflows/test-copilot-safe-outputs-id-token.md

@@ -0,0 +1,24 @@
+---
+on:
+  workflow_dispatch:
+permissions:
+  contents: read
+  issues: read
+engine: copilot
+safe-outputs:
+  noop:
+    max: 1
+  id-token: write
+timeout-minutes: 5
+---
+
+# Test Copilot Safe-Outputs ID Token
+
+Test the `safe-outputs.id-token` configuration which overrides the `id-token`
+permission for the safe_outputs job. Setting `id-token: write` force-adds the
+permission; `id-token: none` disables it.
+
+Use `noop` to confirm the id-token configuration:
+- message: "safe-outputs id-token permission set to write"
+
+Output as JSONL using the `noop` tool.

pkg/cli/workflows/test-copilot-safe-outputs-urls.md

@@ -0,0 +1,25 @@
+---
+on:
+  workflow_dispatch:
+permissions:
+  contents: read
+  issues: write
+engine: copilot
+safe-outputs:
+  add-comment:
+    max: 1
+  urls: allowed-or-code-region
+timeout-minutes: 5
+---
+
+# Test Copilot Safe-Outputs URLs Policy
+
+Test the `safe-outputs.urls` configuration which controls URL sanitization
+policy. Valid values:
+- `allowed-only` (default): redact URLs not in the allowed-domains list
+- `allowed-or-code-region`: also allow URLs inside code blocks/regions
+
+Add a comment summarising the URL policy:
+- message: "This workflow uses the 'allowed-or-code-region' URL policy, which permits URLs inside code blocks even if not in the allowed-domains list."
+
+Output as JSONL using the `add_comment` tool.

pkg/cli/workflows/test-copilot-scripts.md

@@ -0,0 +1,33 @@
+---
+on:
+  workflow_dispatch:
+permissions:
+  contents: read
+  issues: read
+engine: copilot
+safe-outputs:
+  scripts:
+    echo-message:
+      name: Echo Message
+      description: Echo a message back as a noop confirmation
+      inputs:
+        message:
+          description: Message to echo
+          required: true
+          type: string
+      script: |
+        return async function handleEchoMessage(item) {
+          return { success: true, echoed: item.message };
+        };
+timeout-minutes: 5
+---
+
+# Test Copilot Safe-Outputs Scripts
+
+Test the `safe-outputs.scripts` configuration which mounts custom inline
+JavaScript handlers as MCP tools in the safe_outputs job.
+
+Call the `echo_message` tool with:
+- message: "Hello from scripts test"
+
+Output as JSONL using the `echo_message` tool.

pkg/cli/workflows/test-copilot-timeout-minutes.md

@@ -0,0 +1,23 @@
+---
+on:
+  workflow_dispatch:
+permissions:
+  contents: read
+  issues: read
+engine: copilot
+safe-outputs:
+  noop:
+    max: 1
+  timeout-minutes: 30
+timeout-minutes: 5
+---
+
+# Test Copilot Safe-Outputs Timeout Minutes
+
+Test the `safe-outputs.timeout-minutes` configuration which overrides the
+default 45-minute timeout for the safe_outputs job.
+
+Use `noop` to report that the timeout-minutes is configured to 30 minutes:
+- message: "safe-outputs job timeout set to 30 minutes"
+
+Output as JSONL using the `noop` tool.

pkg/workflow/compiler_safe_outputs_config_test.go

@@ -881,6 +881,24 @@ func TestAddHandlerManagerConfigEnvVar(t *testing.T) {
 			checkJSON:    true,
 			expectedKeys: []string{"replace_label"},
 		},
+		{
+			name: "mentions config",
+			safeOutputs: &SafeOutputsConfig{
+				AddComments: &AddCommentsConfig{
+					BaseSafeOutputConfig: BaseSafeOutputConfig{
+						Max: strPtr("1"),
+					},
+				},
+				Mentions: &MentionsConfig{
+					Allowed: []string{"copilot-bot"},
+				},
+			},
+			checkContains: []string{
+				"GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG",
+			},
+			checkJSON:    true,
+			expectedKeys: []string{"add_comment", "mentions"},
+		},
 	}
 
 	for _, tt := range tests {