Soft-fail verified-signatures branch-update rejections in update_pull_request

[Copilot]

PR Sous Chef was failing safe_outputs when update_pull_request.update_branch hit a non-retryable branch-protection rejection from GitHub’s update-branch API. In repos enforcing verified signatures, the synthetic merge commit for “branch from base” is rejected even though the rest of the safe outputs succeed.

• Behavior change

  • Extend update_pull_request non-fatal handling to recognize the verified-signatures ruleset failure:
    • Repository rule violations found
    • Commits must have verified signatures
  • When this specific updateBranch call is rejected, the handler now warns and continues instead of failing the whole safe-output batch.

• Scope

  • Applies only to the branch-from-base sub-operation of update_pull_request.
  • Leaves other update_pull_request failures unchanged.

• Why this is safe

  • The branch update is best-effort metadata maintenance; it should not block unrelated safe outputs such as comment creation, issue creation, or PR field updates.
  • Existing soft-fail cases (already up to date, merge conflict, workflow-permission refusal) continue to use the same path.

• Coverage

  • Add focused tests for:
    • update_branch-only requests hitting verified-signatures rejection
    • mixed requests where branch update is rejected but title/body updates should still apply

const hasVerifiedSignaturesRuleViolation =
  message.includes("repository rule violations found") &&
  /commits?\s+must\s+have\s+verified\s+signatures\b/i.test(message);

return (
  message.includes("there are no new commits on the base branch") ||
  message.includes("merge conflict between base and head") ||
  hasWorkflowsPermissionError ||
  hasVerifiedSignaturesRuleViolation
);

• Fixes [aw-failures] [aw-fix] P1: PR Sous Chef — update_pull_request (branch-from-base) rejected by "verified signatures" rule, failing [Content truncated due to length] #47753