Problem
The create_pull_request safe output handler fails when the git bundle contains a branch ref that doesn't match the branch name declared in the agent's JSONL output. The handler appends a salt suffix to the JSONL branch name but tries to fetch the original (unsalted) name from the bundle.
Error
From the safe_outputs job logs:
Using branch name from JSONL with added salt: ops-review-may09-2026-b48b4d0598d7304f
Branch name sanitized: "ops-review-may09-2026" -> "ops-review-may09-2026-b48b4d0598d7304f"
...
/usr/bin/git fetch /tmp/gh-aw/aw-ops-review-may09-2026.bundle refs/heads/ops-review-may09-2026:refs/heads/ops-review-may09-2026-b48b4d0598d7304f
fatal: couldn't find remote ref refs/heads/ops-review-may09-2026
Error: Failed to apply bundle: The process '/usr/bin/git' failed with exit code 128
Error: ✗ Message 1 (create_pull_request) failed: Failed to apply bundle
The handler reads the branch name ops-review-may09-2026 from the JSONL, then tries to fetch refs/heads/ops-review-may09-2026 from the bundle. But the bundle doesn't contain a ref with that name — the Copilot agent likely created the bundle with the branch under a different ref (possibly just main or an auto-generated name).
Reproduction
The workflow uses a standard create-pull-request safe output:
safe-outputs:
create-pull-request:
title-prefix: "[ops-review] "
labels: [ops-review, automated]
draft: true
allowed-files:
- "docs/ops-reviews/pt-ops-review-*.md"The activation and agent steps succeeded. The agent produced a valid patch (23 KB) and bundle file. The failure occurs only in the safe_outputs job when applying the bundle.
Expected behavior
The safe outputs handler should be able to extract changes from the bundle regardless of the internal ref name the agent used when creating it — either by listing refs in the bundle first (git bundle list-heads) and mapping to the declared branch name, or by ensuring the agent creates the bundle with a ref name that matches the JSONL output.
Related issues
Problem
The
create_pull_requestsafe output handler fails when the git bundle contains a branch ref that doesn't match the branch name declared in the agent's JSONL output. The handler appends a salt suffix to the JSONL branch name but tries to fetch the original (unsalted) name from the bundle.Error
From the
safe_outputsjob logs:The handler reads the branch name
ops-review-may09-2026from the JSONL, then tries to fetchrefs/heads/ops-review-may09-2026from the bundle. But the bundle doesn't contain a ref with that name — the Copilot agent likely created the bundle with the branch under a different ref (possibly justmainor an auto-generated name).Reproduction
github/planning-tracking.github/workflows/ops-review.lock.ymlThe workflow uses a standard
create-pull-requestsafe output:The activation and agent steps succeeded. The agent produced a valid patch (23 KB) and bundle file. The failure occurs only in the
safe_outputsjob when applying the bundle.Expected behavior
The safe outputs handler should be able to extract changes from the bundle regardless of the internal ref name the agent used when creating it — either by listing refs in the bundle first (
git bundle list-heads) and mapping to the declared branch name, or by ensuring the agent creates the bundle with a ref name that matches the JSONL output.Related issues