Check-out from Fork does not work with workflow_call

[strawgate]

Run actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
Event: pull_request
Pull Request #2482
📋 PR Context Details
  Event type: pull_request
  PR number: 2482
  PR state: open
  Head ref: new-workflows
  Head SHA: bde1f0c73f66aad01b85858c139be4055572b0ed
  Head repo: strawgate/private
  Head repo owner: strawgate
  Base ref: main
  Base SHA: 44feb663f657dff6a8c3ed71b735576b76051123
  Base repo: elastic/private
  Base repo owner: elastic
  Is fork PR: true (head.repo.fork flag is true)
  Current repository: elastic/private
  GitHub SHA: 8c90b0515ab226fa290c00e7f8ea653419fb8c1b
🔄 Checkout Strategy
  Event type: pull_request
  Strategy: git fetch + checkout
  Reason: pull_request event runs in merge commit context with PR branch available
Fetching branch: new-workflows from origin
/usr/bin/git fetch origin new-workflows
fatal: couldn't find remote ref new-workflows
❌ Checkout Error Details
Error: ERR_API: Failed to checkout PR branch: The process '/usr/bin/git' failed with exit code 128

[pelikhan]

can you generate prototypical test suite for workflow_call scenarios? (smoke-workflow-call.md of sorts)

[strawgate]

i havent tested this but something like...

workflow:

---
name: Smoke Workflow Call
description: Smoke test validating the full event → trigger → workflow_call → agent → safe-outputs chain across PR, review, comment, and issue events
on:
  workflow_call:
    inputs:
      allowed-bot-users:
        description: "Allowlisted bot actor usernames (comma-separated)"
        type: string
        required: false
        default: "github-actions[bot]"
      additional-instructions:
        description: "Extra instructions appended to the prompt"
        type: string
        required: false
        default: ""
      intensity:
        description: "Review depth: quick or full"
        type: string
        required: false
        default: "full"
    secrets:
      COPILOT_GITHUB_TOKEN:
        required: true
  workflow_dispatch:
  reaction: "eyes"
  status-comment: true
permissions:
  contents: read
  issues: read
  pull-requests: read
engine: copilot
strict: true
imports:
  - shared/gh.md
network:
  allowed:
    - defaults
    - github
tools:
  github:
  bash:
    - "echo *"
    - "cat *"
    - "date"
    - "wc *"
safe-outputs:
  add-comment:
    hide-older-comments: true
    max: 2
  create-issue:
    expires: 2h
    group: true
    close-older-issues: true
    labels: [automation, testing, workflow-call]
  add-labels:
    allowed: [smoke-workflow-call]
  messages:
    footer: "> 🔗 *Reusable workflow smoke test by [{workflow_name}]({run_url})*"
    run-started: "🔗 [{workflow_name}]({run_url}) invoked as a reusable workflow for this {event_type}..."
    run-success: "✅ [{workflow_name}]({run_url}) — workflow_call chain validated."
    run-failure: "❌ [{workflow_name}]({run_url}) {status}. Reusable workflow chain failed."
timeout-minutes: 10
---

# Smoke Test: Event → workflow_call Chain Validation

**IMPORTANT: Keep all outputs extremely short and concise. No verbose explanations.**

This is a **reusable workflow** called by trigger workflows that fire on different GitHub events. It validates that event context, inputs, and secrets flow correctly through the `workflow_call` boundary, and that safe-outputs can target the originating item.

## Step 1: Detect the Triggering Event

Determine which event triggered this workflow by reading `${{ github.event_name }}`. Then run the matching scenario below.

Use bash: `echo "Event: ${{ github.event_name }}"`

## Step 2: Run the Scenario for the Detected Event

### Scenario A: pull_request

If `${{ github.event_name }}` is `pull_request`:

1. **PR context**: Verify `${{ github.event.pull_request.number }}` is a positive integer.
2. **PR metadata**: Verify `${{ github.event.pull_request.title }}` and `${{ github.event.pull_request.head.ref }}` are non-empty.
3. **PR author**: Verify `${{ github.event.pull_request.user.login }}` is non-empty.
4. **PR diff**: Use GitHub MCP tools to fetch files changed in PR #`${{ github.event.pull_request.number }}`. Verify at least one file is returned.
5. **Safe-output targeting PR**: Use `add_comment` (omit `item_number` to auto-target) to post a brief comment confirming: PR number, title, author, number of changed files, and input values received.
6. **Label PR**: If all checks pass, use `add_labels` to add `smoke-workflow-call` to the PR.

### Scenario B: pull_request_review

If `${{ github.event_name }}` is `pull_request_review`:

1. **Review context**: Verify `${{ github.event.review.id }}` is non-empty.
2. **Review state**: Read `${{ github.event.review.state }}` — should be one of `approved`, `changes_requested`, `commented`, `dismissed`.
3. **Review author**: Verify `${{ github.event.review.user.login }}` is non-empty.
4. **Associated PR**: Verify `${{ github.event.pull_request.number }}` is available (the PR the review was submitted on).
5. **Safe-output targeting PR**: Use `add_comment` with `item_number` set to `${{ github.event.pull_request.number }}` to post a brief comment confirming: review ID, state, author, and associated PR number.

### Scenario C: issue_comment

If `${{ github.event_name }}` is `issue_comment`:

1. **Comment context**: Verify `${{ github.event.comment.id }}` is non-empty.
2. **Comment body**: Verify `${{ github.event.comment.body }}` is non-empty.
3. **Comment author**: Verify `${{ github.event.comment.user.login }}` is non-empty.
4. **Parent item**: Determine if this is a PR comment (`${{ github.event.issue.pull_request }}` is non-null) or an issue comment. Report which.
5. **Safe-output targeting parent**: Use `add_comment` with `item_number` set to `${{ github.event.issue.number }}` to post a reply confirming: comment ID, author, parent item number, and whether it's an issue or PR comment.

### Scenario D: issues

If `${{ github.event_name }}` is `issues`:

1. **Issue context**: Verify `${{ github.event.issue.number }}` is a positive integer.
2. **Issue metadata**: Verify `${{ github.event.issue.title }}` is non-empty.
3. **Issue author**: Verify `${{ github.event.issue.user.login }}` is non-empty.
4. **Issue labels**: Read `${{ github.event.issue.labels }}` and report the label names (may be empty).
5. **Safe-output targeting issue**: Use `add_comment` with `item_number` set to `${{ github.event.issue.number }}` to post a comment confirming: issue number, title, author, and labels.

### Scenario E: workflow_dispatch (manual fallback)

If `${{ github.event_name }}` is `workflow_dispatch`:

1. **Context check**: Verify `${{ github.repository }}` and `${{ github.run_id }}` are available.
2. **No event payload**: Confirm there is no PR/issue/comment context (all should be empty). This is expected for manual dispatch.
3. **Skip PR-targeting safe-outputs**: Mark PR/issue-specific tests as ⚠️ skipped.

## Step 3: Common Checks (All Scenarios)

Run these regardless of event type:

1. **Input passthrough**: Read `${{ inputs.intensity }}` and verify it is `"full"` or `"quick"`.
2. **Allowed-bot-users**: Read `${{ inputs.allowed-bot-users }}` and verify it is non-empty.
3. **Additional instructions**: Read `${{ inputs.additional-instructions }}` and report its value (may be empty).
4. **Secret availability**: Verify `${{ secrets.COPILOT_GITHUB_TOKEN }}` is available. Do NOT log the value.
5. **Repository context**: Verify `${{ github.repository }}` is non-empty.
6. **Run context**: Verify `${{ github.run_id }}` and `${{ github.run_attempt }}` are available.

## Output

**CRITICAL: You MUST create an issue regardless of test results.**

1. **Always create an issue** with results:
   - Title: "Smoke: workflow_call (${{ github.event_name }}) - ${{ github.run_id }}"
   - Body:
     - Detected event: `${{ github.event_name }}`
     - Scenario executed: A, B, C, D, or E
     - Each test: ✅ (pass), ❌ (fail), ⚠️ (skipped)
     - Input values: intensity, allowed-bot-users, additional-instructions
     - Event-specific context values (PR number, issue number, comment ID, review state, etc.)
     - Overall: PASS, PARTIAL, or FAIL
     - Run URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

2. **Comment on the triggering item** (PR, issue, or as reply) per the scenario above.

3. If all tests pass and event is `pull_request`, **add label** `smoke-workflow-call`.

**Important**: If no action is needed, you **MUST** call `noop`:

```json
{"noop": {"message": "No action needed: [brief explanation]"}}
```

trigger:

name: Trigger Smoke Workflow Call
on:
  # Scenario A: PR events
  pull_request:
    types: [labeled]

  # Scenario B: PR review submitted
  pull_request_review:
    types: [submitted]

  # Scenario C: Comment on issue or PR
  issue_comment:
    types: [created]

  # Scenario D: Issue opened
  issues:
    types: [labeled]

  # Scenario E: Manual fallback
  workflow_dispatch:

permissions:
  actions: read
  contents: read
  issues: write
  pull-requests: write

jobs:
  # --- Scenario A: pull_request (labeled with smoke-workflow-call) ---
  smoke-pr:
    if: >-
      github.event_name == 'pull_request' &&
      contains(github.event.pull_request.labels.*.name, 'smoke-workflow-call')
    uses: ./.github/workflows/smoke-workflow-call.lock.yml
    with:
      intensity: "full"
      allowed-bot-users: "github-actions[bot],copilot"
      additional-instructions: "Triggered by PR label event."
    secrets:
      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

  # --- Scenario B: pull_request_review (submitted on a PR with the label) ---
  smoke-pr-review:
    if: >-
      github.event_name == 'pull_request_review' &&
      contains(github.event.pull_request.labels.*.name, 'smoke-workflow-call')
    uses: ./.github/workflows/smoke-workflow-call.lock.yml
    with:
      intensity: "full"
      additional-instructions: "Triggered by PR review event."
    secrets:
      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

  # --- Scenario C: issue_comment (comment starts with /smoke-workflow-call) ---
  smoke-comment:
    if: >-
      github.event_name == 'issue_comment' &&
      startsWith(github.event.comment.body, '/smoke-workflow-call')
    uses: ./.github/workflows/smoke-workflow-call.lock.yml
    with:
      intensity: "quick"
      additional-instructions: "Triggered by issue comment event."
    secrets:
      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

  # --- Scenario D: issues (labeled with smoke-workflow-call) ---
  smoke-issue:
    if: >-
      github.event_name == 'issues' &&
      github.event.label.name == 'smoke-workflow-call'
    uses: ./.github/workflows/smoke-workflow-call.lock.yml
    with:
      intensity: "full"
      additional-instructions: "Triggered by issue label event."
    secrets:
      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

  # --- Scenario E: workflow_dispatch (manual, defaults only) ---
  smoke-manual:
    if: github.event_name == 'workflow_dispatch'
    uses: ./.github/workflows/smoke-workflow-call.lock.yml
    secrets:
      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

[pelikhan]

copilot add the workflows referenced above as smoke-workflow-call and smoke-trigger