Sort required arrays in safe output schemas for stable compilation

[Copilot]

Go map iteration order is non-deterministic, causing the required arrays in custom job schemas to change order between compilations. This creates unnecessary diffs in lock files and makes schemas unstable.

Changes

Code fix (pkg/workflow/safe_outputs_config_generation.go):

• Sort requiredFields array before assignment to ensure deterministic output
• Added sort.Strings() call in generateCustomJobToolDefinition()

Schema normalization (embedded JSON):

• Sorted required arrays in pkg/workflow/js/safe_outputs_tools.json (8 tools)
• Sorted required arrays in actions/setup/js/safe_outputs_tools.json (7 tools)

Test coverage:

• Added TestCustomJobToolsRequiredFieldsAreSorted to verify alphabetical ordering

Example

Before:

{
  "inputSchema": {
    "required": ["zebra", "alpha", "middle"]
  }
}

After:

{
  "inputSchema": {
    "required": ["alpha", "middle", "zebra"]
  }
}

All compiled schemas now produce stable, sorted required arrays regardless of map iteration order.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/user
  • Triggering command: /usr/bin/gh gh api user --jq .login k/gh-aw/gh-aw/internal/tools/generate-action-metadata/main.go l/linux_amd64/compile /home/REDACTED/go/pkg/mod/golang.org/[email protected]/pkg/tool/linux_amd64/veuser rg/[email protected] rg/[email protected] t /home/REDACTED/go/pkg/mod/golang.o--jq -ato�� -bool t 548119/b397/vet.cfg -errorsas -ifaceassert l/linux_amd64/link git (http block)
  • Triggering command: /usr/bin/gh gh api user --jq .login ithub/workflows l /usr/bin/git --noprofile t om/different-own--show-toplevel git -c .git .git (http block)
  • Triggering command: /usr/bin/gh gh api user --jq .login ithub/workflows 2949526/b406/_testmain.go 2949526/b415/_pkg_.a mary-test-344817infocmp --noheadings /home/REDACTED/go/xterm-color git -C p-deno.git p-deno.git k/gh-aw/gh-aw/gh-aw l /tmp/go-build334api /usr/bin/gh k/gh-aw/gh-aw/gh--jq (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

The required array in the safe output custom jobs schema should be sorted to be stable.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.