Add guarded body_file support to safe-output update handlers

[Copilot]

Safe outputs required large edited bodies to be emitted inline even when the authoritative content already existed on disk, increasing token pressure for editor/update workflows. This change adds opt-in file-backed bodies for update operations without weakening the existing safe-output security model.

• Scope

  • Adds MVP support for body_file + body_sha256 on:
    • update_issue
    • update_discussion
    • update_pull_request
  • Keeps the feature disabled by default behind per-handler body-file: true

• Runtime safeguards

  • Restricts file reads to RUNNER_TEMP/gh-aw-safe/
  • Rejects traversal, absolute-path escapes, symlink hops, non-regular files, oversized files, and non-UTF-8 content
  • Requires a matching lowercase SHA-256 digest
  • Reads the file once at execution time and uses the in-memory snapshot for the rest of the operation

• Validation and schema

  • Extends safe-output schemas with body_file and body_sha256
  • Enforces:
    • paired fields (body_file requires body_sha256)
    • mutual exclusion (body and body_file cannot both be set)
  • Threads the opt-in compiler config through to the runtime handler registry and tool descriptions

• Pipeline parity

  • Routes file-backed body content through the same sanitizer/validator path already used for inline body
  • Preserves existing staged/non-staged behavior by resolving the body before branching execution paths

• Auditability

  • Emits file-source metadata with the processed update result:
    • normalized allowlisted path
    • SHA-256 digest
    • byte count
  • Does not expose file contents in audit metadata

• Docs

  • Documents body-file: true for the supported update handlers
  • Clarifies the secure usage pattern and runtime constraints

Example:

{
  "type": "update_discussion",
  "discussion_number": 123,
  "body_file": "gh-aw-safe/body.md",
  "body_sha256": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
}

• Fixes safe_outputs: support local body file references with strict runtime safeguards #44951

[github-actions]

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Thanks for starting this work on file-backed body support in safe_outputs! 👋 This is an important feature for secure content delivery, and the checklist clearly outlines the implementation phases.

Status & Next Steps:

Since this is in [WIP] draft status, here's what's needed to move toward readiness:

• Add implementation code — The PR currently has 0 changes. Begin with the inspection phase (safe-outputs runtime & schemas) and then implement the opt-in file-backed body support with strict safeguards.
• Add focused tests — Per your checklist, write unit tests for both happy path (file loading, sanitization, audit metadata) and guardrail failures (blocklist enforcement, size limits, digest validation).
• Update documentation — Add secure body_file usage guidance to the safe-outputs documentation.

Once the code and tests are in place and the checklist items are completed, this should be ready for review.

Keep up the great progress! 🚀

Generated by ✅ Contribution Check · aut00 · 64.1 AIC · ⊞ 8.4K · ◷