Convert safe outputs MCP server to node process with individual module files

pkg/workflow/compiler_jobs.go

@@ -1167,9 +1167,12 @@ func (c *Compiler) buildMainJob(data *WorkflowData, activationJobCreated bool) (
 		env["GH_AW_SAFE_OUTPUTS"] = "/tmp/gh-aw/safeoutputs/outputs.jsonl"
 
 		// Set GH_AW_MCP_LOG_DIR for safe outputs MCP server logging
+		// Store in mcp-logs directory so it's included in mcp-logs artifact
 		env["GH_AW_MCP_LOG_DIR"] = "/tmp/gh-aw/mcp-logs/safeoutputs"
 
-		// Config is written to /tmp/gh-aw/safeoutputs/config.json file, not passed as env var
+		// Set config and tools paths (files are written to these paths)
+		env["GH_AW_SAFE_OUTPUTS_CONFIG_PATH"] = "/tmp/gh-aw/safeoutputs/config.json"
+		env["GH_AW_SAFE_OUTPUTS_TOOLS_PATH"] = "/tmp/gh-aw/safeoutputs/tools.json"
 
 		// Add asset-related environment variables if upload-assets is configured
 		if data.SafeOutputs.UploadAssets != nil {

pkg/workflow/js.go

@@ -258,6 +258,9 @@ var safeOutputsHandlersScript string
 //go:embed js/safe_outputs_tools_loader.cjs
 var safeOutputsToolsLoaderScript string
 
+//go:embed js/safe_outputs_bootstrap.cjs
+var safeOutputsBootstrapScript string
+
 // GetJavaScriptSources returns a map of all embedded JavaScript sources
 // The keys are the relative paths from the js directory
 func GetJavaScriptSources() map[string]string {
@@ -315,6 +318,7 @@ func GetJavaScriptSources() map[string]string {
 		"safe_outputs_append.cjs":           safeOutputsAppendScript,
 		"safe_outputs_handlers.cjs":         safeOutputsHandlersScript,
 		"safe_outputs_tools_loader.cjs":     safeOutputsToolsLoaderScript,
+		"safe_outputs_bootstrap.cjs":        safeOutputsBootstrapScript,
 		"safe_outputs_mcp_server.cjs":       safeOutputsMCPServerScriptSource,
 		"add_copilot_reviewer.cjs":          addCopilotReviewerScriptSource,
 		"add_reaction_and_edit_comment.cjs": addReactionAndEditCommentScriptSource,
@@ -865,3 +869,8 @@ func GetSafeOutputsHandlersScript() string {
 func GetSafeOutputsToolsLoaderScript() string {
 	return safeOutputsToolsLoaderScript
 }
+
+// GetSafeOutputsBootstrapScript returns the embedded safe_outputs_bootstrap.cjs script
+func GetSafeOutputsBootstrapScript() string {
+	return safeOutputsBootstrapScript
+}

pkg/workflow/js/collect_ndjson_output.cjs

@@ -175,15 +175,21 @@ async function main() {
   // Read config from file instead of environment variable
   const configPath = process.env.GH_AW_SAFE_OUTPUTS_CONFIG_PATH || "/tmp/gh-aw/safeoutputs/config.json";
   let safeOutputsConfig;
+  core.info(`[INGESTION] Reading config from: ${configPath}`);
   try {
     if (fs.existsSync(configPath)) {
       const configFileContent = fs.readFileSync(configPath, "utf8");
+      core.info(`[INGESTION] Raw config content: ${configFileContent}`);
       safeOutputsConfig = JSON.parse(configFileContent);
+      core.info(`[INGESTION] Parsed config keys: ${JSON.stringify(Object.keys(safeOutputsConfig))}`);
+    } else {
+      core.info(`[INGESTION] Config file does not exist at: ${configPath}`);
     }
   } catch (error) {
     core.warning(`Failed to read config file from ${configPath}: ${error instanceof Error ? error.message : String(error)}`);
   }
 
+  core.info(`[INGESTION] Output file path: ${outputFile}`);
   if (!outputFile) {
     core.info("GH_AW_SAFE_OUTPUTS not set, no output to collect");
     core.setOutput("output", "");
@@ -199,13 +205,16 @@ async function main() {
     core.info("Output file is empty");
   }
   core.info(`Raw output content length: ${outputContent.length}`);
+  core.info(`[INGESTION] First 500 chars of output: ${outputContent.substring(0, 500)}`);
   let expectedOutputTypes = {};
   if (safeOutputsConfig) {
     try {
       // safeOutputsConfig is already a parsed object from the file
       // Normalize all config keys to use underscores instead of dashes
+      core.info(`[INGESTION] Normalizing config keys (dash -> underscore)`);
       expectedOutputTypes = Object.fromEntries(Object.entries(safeOutputsConfig).map(([key, value]) => [key.replace(/-/g, "_"), value]));
-      core.info(`Expected output types: ${JSON.stringify(Object.keys(expectedOutputTypes))}`);
+      core.info(`[INGESTION] Expected output types after normalization: ${JSON.stringify(Object.keys(expectedOutputTypes))}`);
+      core.info(`[INGESTION] Expected output types full config: ${JSON.stringify(expectedOutputTypes)}`);
     } catch (error) {
       const errorMsg = error instanceof Error ? error.message : String(error);
       core.info(`Warning: Could not parse safe-outputs config: ${errorMsg}`);
@@ -220,6 +229,7 @@ async function main() {
   for (let i = 0; i < lines.length; i++) {
     const line = lines[i].trim();
     if (line === "") continue;
+    core.info(`[INGESTION] Processing line ${i + 1}: ${line.substring(0, 200)}...`);
     try {
       const item = parseJsonWithRepair(line);
       if (item === undefined) {
@@ -231,10 +241,13 @@ async function main() {
         continue;
       }
       // Normalize type to use underscores (convert any dashes to underscores for resilience)
+      const originalType = item.type;
       const itemType = item.type.replace(/-/g, "_");
+      core.info(`[INGESTION] Line ${i + 1}: Original type='${originalType}', Normalized type='${itemType}'`);
       // Update item.type to normalized value
       item.type = itemType;
       if (!expectedOutputTypes[itemType]) {
+        core.warning(`[INGESTION] Line ${i + 1}: Type '${itemType}' not found in expected types: ${JSON.stringify(Object.keys(expectedOutputTypes))}`);
         errors.push(`Line ${i + 1}: Unexpected output type '${itemType}'. Expected one of: ${Object.keys(expectedOutputTypes).join(", ")}`);
         continue;
       }

pkg/workflow/js/safe_outputs_append.cjs

@@ -1,5 +1,4 @@
 // @ts-check
-/// <reference types="@actions/github-script" />
 
 const fs = require("fs");
 

pkg/workflow/js/safe_outputs_bootstrap.cjs

@@ -0,0 +1,74 @@
+// @ts-check
+
+/**
+ * Safe Outputs Bootstrap Module
+ *
+ * This module provides shared bootstrap logic for safe-outputs MCP server.
+ * It handles configuration loading, tools loading, and cleanup that is
+ * common initialization logic.
+ *
+ * Usage:
+ *   const { bootstrapSafeOutputsServer } = require("./safe_outputs_bootstrap.cjs");
+ *   const { config, outputFile, tools } = bootstrapSafeOutputsServer(server);
+ */
+
+const fs = require("fs");
+const { loadConfig } = require("./safe_outputs_config.cjs");
+const { loadTools } = require("./safe_outputs_tools_loader.cjs");
+
+/**
+ * @typedef {Object} Logger
+ * @property {Function} debug - Debug logging function
+ * @property {Function} debugError - Error logging function
+ */
+
+/**
+ * @typedef {Object} BootstrapResult
+ * @property {Object} config - Loaded configuration
+ * @property {string} outputFile - Path to the output file
+ * @property {Array} tools - Loaded tool definitions
+ */
+
+/**
+ * Bootstrap a safe-outputs server by loading configuration and tools.
+ * This function performs the common initialization steps.
+ *
+ * @param {Logger} logger - Logger instance for debug messages
+ * @returns {BootstrapResult} Configuration, output file path, and loaded tools
+ */
+function bootstrapSafeOutputsServer(logger) {
+  // Load configuration
+  logger.debug("Loading safe-outputs configuration");
+  const { config, outputFile } = loadConfig(logger);
+
+  // Load tools
+  logger.debug("Loading safe-outputs tools");
+  const tools = loadTools(logger);
+
+  return { config, outputFile, tools };
+}
+
+/**
+ * Delete the configuration file to ensure no secrets remain on disk.
+ * This should be called after the server has been configured and started.
+ *
+ * @param {Logger} logger - Logger instance for debug messages
+ */
+function cleanupConfigFile(logger) {
+  const configPath = process.env.GH_AW_SAFE_OUTPUTS_CONFIG_PATH || "/tmp/gh-aw/safeoutputs/config.json";
+
+  try {
+    if (fs.existsSync(configPath)) {
+      fs.unlinkSync(configPath);
+      logger.debug(`Deleted configuration file: ${configPath}`);
+    }
+  } catch (error) {
+    logger.debugError("Warning: Could not delete configuration file: ", error);
+    // Continue anyway - the server is already running
+  }
+}
+
+module.exports = {
+  bootstrapSafeOutputsServer,
+  cleanupConfigFile,
+};

pkg/workflow/js/safe_outputs_bootstrap.test.cjs

@@ -0,0 +1,153 @@
+// @ts-check
+
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+const assert = require("assert");
+
+const { bootstrapSafeOutputsServer, cleanupConfigFile } = require("./safe_outputs_bootstrap.cjs");
+
+describe("safe_outputs_bootstrap", () => {
+  let tempDir;
+
+  beforeEach(() => {
+    // Create a temporary directory for test files
+    tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "test-safe-outputs-bootstrap-"));
+  });
+
+  afterEach(() => {
+    // Clean up temporary directory
+    if (tempDir && fs.existsSync(tempDir)) {
+      fs.rmSync(tempDir, { recursive: true, force: true });
+    }
+    // Clean up environment variables
+    delete process.env.GH_AW_SAFE_OUTPUTS_CONFIG_PATH;
+    delete process.env.GH_AW_SAFE_OUTPUTS_TOOLS_PATH;
+    delete process.env.GH_AW_SAFE_OUTPUTS;
+  });
+
+  describe("bootstrapSafeOutputsServer", () => {
+    it("should load configuration and tools successfully", () => {
+      // Setup test configuration and tools files
+      const configPath = path.join(tempDir, "config.json");
+      const toolsPath = path.join(tempDir, "tools.json");
+      const config = { "create-pull-request": { enabled: true } };
+      const tools = [{ name: "create_pull_request", description: "Test tool" }];
+
+      fs.writeFileSync(configPath, JSON.stringify(config));
+      fs.writeFileSync(toolsPath, JSON.stringify(tools));
+
+      process.env.GH_AW_SAFE_OUTPUTS_CONFIG_PATH = configPath;
+      process.env.GH_AW_SAFE_OUTPUTS_TOOLS_PATH = toolsPath;
+      process.env.GH_AW_SAFE_OUTPUTS = path.join(tempDir, "outputs.jsonl");
+
+      // Create mock logger
+      const logger = {
+        debug: () => {},
+        debugError: () => {},
+      };
+
+      // Call bootstrap
+      const result = bootstrapSafeOutputsServer(logger);
+
+      // Verify results
+      assert.ok(result.config);
+      assert.strictEqual(result.config.create_pull_request.enabled, true);
+      assert.ok(result.tools);
+      assert.strictEqual(result.tools.length, 1);
+      assert.strictEqual(result.tools[0].name, "create_pull_request");
+      assert.ok(result.outputFile);
+      assert.strictEqual(result.outputFile, path.join(tempDir, "outputs.jsonl"));
+    });
+
+    it("should handle missing configuration file gracefully", () => {
+      // Setup only tools file
+      const toolsPath = path.join(tempDir, "tools.json");
+      const tools = [];
+
+      fs.writeFileSync(toolsPath, JSON.stringify(tools));
+
+      process.env.GH_AW_SAFE_OUTPUTS_CONFIG_PATH = path.join(tempDir, "nonexistent.json");
+      process.env.GH_AW_SAFE_OUTPUTS_TOOLS_PATH = toolsPath;
+      process.env.GH_AW_SAFE_OUTPUTS = path.join(tempDir, "outputs.jsonl");
+
+      // Create mock logger
+      const logger = {
+        debug: () => {},
+        debugError: () => {},
+      };
+
+      // Call bootstrap
+      const result = bootstrapSafeOutputsServer(logger);
+
+      // Verify it uses empty config
+      assert.ok(result.config);
+      assert.strictEqual(Object.keys(result.config).length, 0);
+    });
+
+    it("should handle missing tools file gracefully", () => {
+      // Setup only config file
+      const configPath = path.join(tempDir, "config.json");
+      const config = {};
+
+      fs.writeFileSync(configPath, JSON.stringify(config));
+
+      process.env.GH_AW_SAFE_OUTPUTS_CONFIG_PATH = configPath;
+      process.env.GH_AW_SAFE_OUTPUTS_TOOLS_PATH = path.join(tempDir, "nonexistent.json");
+      process.env.GH_AW_SAFE_OUTPUTS = path.join(tempDir, "outputs.jsonl");
+
+      // Create mock logger
+      const logger = {
+        debug: () => {},
+        debugError: () => {},
+      };
+
+      // Call bootstrap
+      const result = bootstrapSafeOutputsServer(logger);
+
+      // Verify it uses empty tools array
+      assert.ok(result.tools);
+      assert.strictEqual(result.tools.length, 0);
+    });
+  });
+
+  describe("cleanupConfigFile", () => {
+    it("should delete config file if it exists", () => {
+      const configPath = path.join(tempDir, "config.json");
+      fs.writeFileSync(configPath, JSON.stringify({}));
+
+      process.env.GH_AW_SAFE_OUTPUTS_CONFIG_PATH = configPath;
+
+      // Create mock logger
+      const logger = {
+        debug: () => {},
+        debugError: () => {},
+      };
+
+      // Verify file exists before cleanup
+      assert.ok(fs.existsSync(configPath));
+
+      // Call cleanup
+      cleanupConfigFile(logger);
+
+      // Verify file is deleted
+      assert.ok(!fs.existsSync(configPath));
+    });
+
+    it("should handle missing config file gracefully", () => {
+      const configPath = path.join(tempDir, "nonexistent.json");
+      process.env.GH_AW_SAFE_OUTPUTS_CONFIG_PATH = configPath;
+
+      // Create mock logger
+      const logger = {
+        debug: () => {},
+        debugError: () => {},
+      };
+
+      // Should not throw
+      assert.doesNotThrow(() => {
+        cleanupConfigFile(logger);
+      });
+    });
+  });
+});

pkg/workflow/js/safe_outputs_config.cjs

@@ -1,5 +1,4 @@
 // @ts-check
-/// <reference types="@actions/github-script" />
 
 const fs = require("fs");
 const path = require("path");

pkg/workflow/js/safe_outputs_handlers.cjs

@@ -1,5 +1,4 @@
 // @ts-check
-/// <reference types="@actions/github-script" />
 
 const fs = require("fs");
 const path = require("path");

pkg/workflow/js/safe_outputs_mcp_client.cjs

@@ -1,5 +1,4 @@
 // @ts-check
-/// <reference types="@actions/github-script" />
 
 const { spawn } = require("child_process");
 const path = require("path");