[aw] Harden Code Radiator safe-outputs for scheduled runs

[Copilot]

Code Radiator failed on main scheduled execution because safe outputs assumed PR-trigger context and rejected dynamic base overrides. This updates workflow constraints so scheduled runs can safely update existing merge PRs and create new ones across target branches.

• Safe output policy updates

  • Enabled per-run PR base override for expected branch families:
    • safe-outputs.create-pull-request.allowed-base-branches: ["net*.0", "xcode*"]
  • Switched PR-branch push targeting from implicit triggering PR to explicit any-PR mode:
    • safe-outputs.push-to-pull-request-branch.target: "*"
  • Added push guardrail to restrict eligible PRs:
    • safe-outputs.push-to-pull-request-branch.title-prefix: "🤖 Merge 'main' => '"

• Checkout behavior aligned to safe-output targeting

  • Added wildcard ref fetch config required for target: "*" PR-branch pushes:
    • checkout.fetch: ["*"]
    • checkout.fetch-depth: 0

• Compiled workflow artifact refresh

  • Regenerated .github/workflows/code-radiator.lock.yml from updated source workflow frontmatter.

checkout:
  fetch: ["*"]
  fetch-depth: 0

safe-outputs:
  create-pull-request:
    max: 10
    allowed-base-branches:
      - "net*.0"
      - "xcode*"
  push-to-pull-request-branch:
    max: 10
    target: "*"
    title-prefix: "🤖 Merge 'main' => '"

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/actions/checkout/git/ref/tags/v6.0.2
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6.0.2 --jq [.object.sha, .object.type] | @tsv .js (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6.0.2 --jq [.object.sha, .object.type] | @tsv (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6.0.2 --jq [.object.sha, .object.type] | @tsv 0 -j ACCEPT (http block)
• https://api.github.com/repos/actions/download-artifact/git/ref/tags/v8.0.1
  • Triggering command: /usr/bin/gh gh api /repos/actions/download-artifact/git/ref/tags/v8.0.1 --jq [.object.sha, .object.type] | @tsv (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/download-artifact/git/ref/tags/v8.0.1 --jq [.object.sha, .object.type] | @tsv INVALID,NEW -j DROP (http block)
• https://api.github.com/repos/actions/setup-node/git/ref/tags/v6.4.0
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6.4.0 --jq [.object.sha, .object.type] | @tsv (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6.4.0 --jq [.object.sha, .object.type] | @tsv INVALID,NEW -j DROP (http block)
• https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v7.0.1
  • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v7.0.1 --jq [.object.sha, .object.type] | @tsv (http block)
• https://api.github.com/repos/dotnet/macios
  • Triggering command: /usr/bin/gh gh api /repos/dotnet/macios --jq .visibility (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

Hardens the Code Radiator agentic workflow configuration so scheduled runs (non-PR context) can still safely create/update merge PRs across expected target branch families, while tightening “safe outputs” constraints to prevent unintended write targets.

Changes:

• Adds checkout configuration to fetch full history and additional refs needed for wildcard PR targeting.
• Updates safe-output policy to allow PR base overrides for net*.0/xcode* and to enable “any PR” branch pushes gated by a title prefix.
• Regenerates the compiled workflow artifact (code-radiator.lock.yml) to reflect the frontmatter changes.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/code-radiator.md	Updates frontmatter for checkout fetch behavior and safe-outputs constraints for scheduled runs.
.github/workflows/code-radiator.lock.yml	Regenerated compiled workflow reflecting the updated checkout and safe-outputs policy.