[Safe Outputs Conformance] USE-001: safe_outputs_bootstrap.cjs runtime-policy error lacks standardized error code

[github-actions]

Conformance Check Failure

Check ID: USE-001
Severity: LOW
Category: Usability (Error Code Standardization)

Problem Description

The Safe Outputs conformance checker (USE-001) flags actions/setup/js/safe_outputs_bootstrap.cjs as a handler that throws an error but does not use a standardized error code from the catalog (E001-E010).

The file raises a runtime-policy violation via a bare throw new Error(message) when create-pull-request is disabled by runtime policy (GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST=false). Unlike other handlers, this error message carries no standardized E0XX code, so downstream consumers cannot programmatically classify the failure. Standardized error codes are a spec usability requirement (Section: Error Code Table, codes E001-E010).

Affected Components

• File: actions/setup/js/safe_outputs_bootstrap.cjs (function enforceCreatePullRequestRuntimePolicy, the throw new Error(message) around line 71)
• Handlers: single occurrence — this is the only handler flagged by USE-001

🔍 Current vs Expected Behavior

Current Behavior

const message = `create-pull-request is disabled by runtime policy: ${policyVarName}=false. ` +
  `Remove safe-outputs.create-pull-request or set ${policyVarName}=true.`;
logger.debugError(message);
throw new Error(message);

The thrown error contains no standardized E0XX code. The USE-001 heuristic (grep for E[0-9]{3}|ERROR_|ERR_) finds none and reports the file as non-conformant.

Expected Behavior

Per the Error Code Table (E001-E010) in the Safe Outputs specification, handler errors surfaced to users SHOULD carry a standardized error code so failures are programmatically classifiable and consistent with the rest of the codebase (which already uses E000-E010, E099).

Remediation Steps

Suitable for a Copilot coding agent:

1. Review the standardized Error Code Table (E001-E010) in docs/src/content/docs/specs/safe-outputs-specification.md and pick the code that best fits a runtime-policy denial of a safe-output type (a policy/authorization denial — align with how existing handlers code config/authorization failures such as E009; if no existing code fits a runtime-policy disable, propose extending the catalog rather than reusing an unrelated code).
2. Prefix the thrown error message in enforceCreatePullRequestRuntimePolicy with the chosen code, e.g. ${CODE}: create-pull-request is disabled by runtime policy: ..., matching the format used elsewhere in actions/setup/js/*.cjs.
3. If a source .cjs is generated/compiled from a Go template or other source, apply the change at the source of truth and regenerate the .cjs — do not hand-edit generated output.
4. Add or update a unit test asserting the thrown error message includes the standardized code.

Verification

bash scripts/check-safe-outputs-conformance.sh

Check USE-001 should report PASS (no "may not use standardized error codes" for safe_outputs_bootstrap.cjs).

References

• Safe Outputs Specification: docs/src/content/docs/specs/safe-outputs-specification.md (Error Code Table, E001-E010)
• Conformance Checker: scripts/check-safe-outputs-conformance.sh (USE-001, lines 196-225)
• Run ID: 29394104524
• Date: 2026-07-15

---

Note: The only other finding this run was CI-004 (LOW), which the checker itself marks as informational-only ("Not failing here — implementation details vary") — no issue created for it. See workflow summary.

Generated by ✅ Daily Safe Outputs Conformance Checker · 67.6 AIC · ⌖ 13.5 AIC · ⊞ 6.4K · ◷

• expires on Jul 15, 2026, 10:31 PM UTC-08:00

[github-actions]

This issue is being closed as outdated. A newer issue has been created: #45934

View newer issue

---

This action was performed automatically by the Daily Safe Outputs Conformance Checker workflow.