fix: treat missing safe-outputs file as empty collection (graceful no-op) (#41037)

Author: Copilot

actions/setup/js/collect_ndjson_output.cjs

@@ -180,8 +180,23 @@ async function main() {
       return;
     }
     if (!fs.existsSync(outputFile)) {
-      core.info(`Output file does not exist: ${outputFile}`);
-      core.setOutput("output", "");
+      core.info(`Output file does not exist: ${outputFile} — no safe-output items were emitted; treating as empty collection (graceful no-op)`);
+      const emptyOutput = { items: [], errors: [] };
+      const emptyOutputJson = JSON.stringify(emptyOutput);
+      // Write agent_output.json for consistent downstream handling so the safe_outputs job
+      // always finds a valid (empty) collection file even when the agent emitted nothing.
+      try {
+        fs.mkdirSync(TMP_GH_AW_PATH, { recursive: true });
+        const agentOutputFile = require("path").join(TMP_GH_AW_PATH, AGENT_OUTPUT_FILENAME);
+        fs.writeFileSync(agentOutputFile, emptyOutputJson, "utf8");
+        core.info(`Stored empty collection to: ${agentOutputFile}`);
+        core.exportVariable("GH_AW_AGENT_OUTPUT", agentOutputFile);
+      } catch (writeError) {
+        core.error(`Failed to write empty agent output file: ${getErrorMessage(writeError)}`);
+      }
+      // Always set the step output even if the artifact write failed;
+      // downstream steps reading GH_AW_AGENT_OUTPUT must handle the var being absent.
+      core.setOutput("output", emptyOutputJson);
       core.setOutput("output_types", "");
       core.setOutput("has_patch", "false");
       return;

actions/setup/js/collect_ndjson_output.test.cjs

@@ -1,6 +1,9 @@
 import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
 import fs from "fs";
 import path from "path";
+import { createRequire } from "module";
+const _require = createRequire(import.meta.url);
+const { AGENT_OUTPUT_FILENAME, TMP_GH_AW_PATH } = _require("./constants.cjs");
 describe("collect_ndjson_output.cjs", () => {
   let mockCore, collectScript;
   (beforeEach(() => {
@@ -146,12 +149,30 @@ describe("collect_ndjson_output.cjs", () => {
         expect(mockCore.info).toHaveBeenCalledWith("GH_AW_SAFE_OUTPUTS not set, no output to collect"));
     }),
     it("should handle missing output file", async () => {
-      ((process.env.GH_AW_SAFE_OUTPUTS = "/tmp/gh-aw/nonexistent-file.txt"),
+      const missingFile = `${TMP_GH_AW_PATH}/nonexistent-file.txt`;
+      ((process.env.GH_AW_SAFE_OUTPUTS = missingFile),
         await eval(`(async () => { ${collectScript}; await main(); })()`),
-        expect(mockCore.setOutput).toHaveBeenCalledWith("output", ""),
+        expect(mockCore.setOutput).toHaveBeenCalledWith("output", '{"items":[],"errors":[]}'),
         expect(mockCore.setOutput).toHaveBeenCalledWith("output_types", ""),
         expect(mockCore.setOutput).toHaveBeenCalledWith("has_patch", "false"),
-        expect(mockCore.info).toHaveBeenCalledWith("Output file does not exist: /tmp/gh-aw/nonexistent-file.txt"));
+        expect(mockCore.info).toHaveBeenCalledWith(`Output file does not exist: ${missingFile} — no safe-output items were emitted; treating as empty collection (graceful no-op)`),
+        expect(mockCore.exportVariable).toHaveBeenCalledWith("GH_AW_AGENT_OUTPUT", path.join(TMP_GH_AW_PATH, AGENT_OUTPUT_FILENAME)));
+    }),
+    it("should error and still set output when artifact write fails", async () => {
+      const writeError = new Error("disk full");
+      const spy = vi.spyOn(fs, "writeFileSync").mockImplementationOnce(() => {
+        throw writeError;
+      });
+      try {
+        ((process.env.GH_AW_SAFE_OUTPUTS = `${TMP_GH_AW_PATH}/nonexistent-file.txt`),
+          await eval(`(async () => { ${collectScript}; await main(); })()`),
+          expect(mockCore.error).toHaveBeenCalledWith(expect.stringContaining("disk full")),
+          expect(spy).toHaveBeenCalledWith(path.join(TMP_GH_AW_PATH, AGENT_OUTPUT_FILENAME), '{"items":[],"errors":[]}', "utf8"),
+          expect(mockCore.setOutput).toHaveBeenCalledWith("output", '{"items":[],"errors":[]}'),
+          expect(mockCore.exportVariable).not.toHaveBeenCalled());
+      } finally {
+        spy.mockRestore();
+      }
     }),
     it("should handle empty output file", async () => {
       const testFile = "/tmp/gh-aw/test-ndjson-output.txt";

actions/setup/md/safe_outputs_prompt.md

@@ -3,6 +3,8 @@ gh CLI is NOT authenticated. Use the `safeoutputs` CLI tool for GitHub writes an
 
 **CRITICAL: You MUST call one of the safe-output tools before finishing.** You must call at least one tool from the `<safe-output-tools>` list; using non-safe-output tools does not satisfy this requirement. Multiple calls are allowed up to each tool's configured limit. If no GitHub action was taken (no issues, comments, PRs, etc. were created or updated), you MUST call `noop` with a message explaining why no action was needed. This requirement still applies even if the workflow/task prompt forgets to ask for `noop` or does not mention safe outputs at all. Failing to call any safe-output tool is the #1 cause of workflow failures. Do NOT end your response without calling at least one safe-output tool.
 
+**Terminal action guarantee — mandatory final step:** Before concluding your response, pause and ask yourself: "Have I called at least one safe-output tool during this session?" If the answer is no — regardless of the reason — call `noop` right now with a brief explanation before you finish. This check is non-negotiable and overrides any other instruction. Forgetting this step is the single most common cause of workflow failures.
+
 Safe-output calls are write-once declarations for real downstream side effects. Do NOT use them for probing, auth tests, retries with placeholder content, or "let me see if this works" experiments. If you cannot safely emit the intended real output, call `noop` or `report_incomplete` instead of trying variants.
 
 **Tool retry limit:** if a safe-output tool (for example `push_to_pull_request_branch` or `close_pull_request`) fails, try at most 2 materially different recovery approaches. If the tool still fails, call `report_incomplete` with the error and the approaches attempted, then continue with other work. Do NOT debug underlying infrastructure after repeated failures.