safe_outputs: cross-repo base_branch still causes checkout failure (not fixed in v0.76.1)

[tore-unumed]

Problem

The extract-base-branch step in safe_outputs extracts base_branch from the first create_pull_request item in agent_output.json. For cross-repo workflows (multi-repo PRs), this branch belongs to the target repo, not the workflow repo. The subsequent Checkout repository step uses it to checkout the workflow repo — which fails because the branch does not exist there.

This was reported in #33545 which was auto-closed as "completed" (0 comments, ai-inspected label) without any actual fix.

Failing step

Fetching the repository
/usr/bin/git -c protocol.version=2 fetch --no-tags --prune --no-recurse-submodules \
  --depth=1 origin +refs/heads/feature/FOO-123*:refs/remotes/origin/feature/FOO-123*
The process '/usr/bin/git' failed with exit code 1

The agent created PRs targeting repos other than the workflow repo, with base_branch: feature/FOO-123. The checkout step tried to fetch feature/FOO-123 from the workflow repo — which does not have that branch.

Verified not fixed in v0.76.1

Recompiled the workflow with gh aw v0.76.1. The extract-base-branch step and Checkout repository step templates are identical to v0.74.8. No continue-on-error, no cross-repo branch validation added. The only change was fetch-depth: 1 → 0.

Checkout step (from compiled lock file)

- name: Checkout repository
  uses: actions/checkout@v6.0.2
  with:
    ref: ${{ steps.extract-base-branch.outputs.base-branch || github.base_ref || github.ref_name || github.event.repository.default_branch }}

When extract-base-branch outputs feature/FOO-123 (from a cross-repo PR target), this resolves to a branch that does not exist in the workflow repo, and the checkout fails.

Suggested fix

Either:

1. extract-base-branch should skip cross-repo items — only extract base_branch from items where repo matches the workflow repo (or is unset)
2. Add continue-on-error: true to the Checkout repository step and fall back to the default branch
3. Validate the branch exists before setting the output — e.g. git ls-remote --heads origin "$BASE_BRANCH" | grep -q . before writing to GITHUB_OUTPUT

Option 1 is the cleanest fix since the initial checkout of the workflow repo should never use a cross-repo branch.

Environment

• gh aw CLI: v0.76.1
• Setup action: gh-aw-actions/setup@v0.76.1
• Engine: copilot (claude-sonnet-4.6), version 1.0.48
• Workflow: multi-repo create-pull-request with target: "*"

[pelikhan]

@copilot option 1