🔧 Fix multiple bugs with create and push to PRs

[dsyme]

Summary

• Fork PR protection: Export GH_AW_IS_FORK_PR env var during PR checkout and reject fork PRs early in push_to_pull_request_branch to prevent unauthorized pushes to fork repositories
• Cross-repo patch support: Switch git am to --3way mode, add incremental patch generation mode, and add a cross-repo fallback strategy (Strategy 3) for scenarios where GITHUB_SHA or remote refs are unavailable (e.g. persist-credentials: false)
• CI trigger safety: Restrict the extra empty CI-trigger commit to branches with exactly 1 new commit, and fix process.env restoration in tests to mutate in place rather than replacing the object reference

[Copilot]

Pull request overview

Improves reliability and security of the “create/push to PR” workflow outputs by hard-blocking fork PR pushes, making patch generation more robust for cross-repo checkouts, and tightening the “extra empty commit” CI-trigger behavior.

Changes:

• Add fork-PR detection/export and enforce early rejection for push-to-PR-branch flows.
• Enhance patch generation/application for cross-repo scenarios (incremental patch mode, git am --3way, additional fallback strategy).
• Restrict the CI-trigger empty commit to cases with exactly 1 new commit, and fix process.env restoration patterns in tests.

Reviewed changes

Copilot reviewed 23 out of 23 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
docs/src/content/docs/reference/safe-outputs.md	Documents fork PR limitation for push-to-pull-request-branch.
actions/setup/js/workflow_metadata_helpers.test.cjs	Restores process.env via in-place mutation to avoid breaking Node env semantics.
actions/setup/js/safe_outputs_mcp_server_defaults.test.cjs	Updates env cleanup to mutate process.env in place.
actions/setup/js/safe_outputs_mcp_large_content.test.cjs	Updates env cleanup to mutate process.env in place.
actions/setup/js/safe_outputs_handlers.test.cjs	Adds fork PR rejection tests and updates expected patch-generation error text; removes // @ts-check.
actions/setup/js/safe_outputs_handlers.cjs	Rejects fork PRs early (via GH_AW_IS_FORK_PR) and switches to incremental patch generation for PR-branch pushes.
actions/setup/js/safe_outputs_branch_detection.test.cjs	Updates env cleanup to mutate process.env in place.
actions/setup/js/push_to_pull_request_branch.test.cjs	Adds extensive unit test coverage for push-to-PR-branch scenarios (context variations, forks, errors, CI trigger behavior).
actions/setup/js/push_to_pull_request_branch.cjs	Adds cross-repo repo resolution + fork detection; uses git am --3way; counts new commits to gate CI-trigger empty commit.
actions/setup/js/interpolate_prompt.test.cjs	Updates env cleanup to mutate process.env in place.
actions/setup/js/handle_noop_message.test.cjs	Updates env cleanup to mutate process.env in place.
actions/setup/js/git_patch_integration.test.cjs	Adds integration-style tests that execute real git commands for patch generation/application scenarios.
actions/setup/js/generate_git_patch.test.cjs	Adds tests for cross-repo checkout behavior and incremental mode; adds sanitization/path tests.
actions/setup/js/generate_git_patch.cjs	Adds patch generation modes (full vs incremental), improves cross-repo resilience, and adds a remote-ref based fallback strategy.
actions/setup/js/extra_empty_commit.test.cjs	Adds tests validating newCommitCount gating behavior.
actions/setup/js/extra_empty_commit.cjs	Gates extra empty commit on newCommitCount === 1 to reduce CI-trigger risk/loops.
actions/setup/js/create_pull_request.cjs	Applies patches with git am --3way and gates CI-trigger empty commit using computed commit count.
actions/setup/js/create_issue.test.cjs	Updates env cleanup to mutate process.env in place; removes // @ts-check.
actions/setup/js/create_discussion_labels.test.cjs	Updates env cleanup to mutate process.env in place.
actions/setup/js/create_discussion_fallback.test.cjs	Updates env cleanup to mutate process.env in place.
actions/setup/js/create_discussion_category_normalization.test.cjs	Updates env cleanup to mutate process.env in place.
actions/setup/js/checkout_pr_branch.test.cjs	Adds assertions for exporting GH_AW_IS_FORK_PR and updates mocks accordingly.
actions/setup/js/checkout_pr_branch.cjs	Exports GH_AW_IS_FORK_PR during PR checkout for downstream fork-safe behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.