Suggested test: copilot/sdk-create-pull-request-git-permissions #16667

Motivation

Link: github/gh-aw#61430 — Fix Copilot SDK multiword shell prefix matching and denial-guard hang

Git subcommands auto-granted by safe-outputs.create-pull-request (e.g. shell(git checkout:*), shell(git branch:*)) were rejected by the Copilot SDK driver because the permission matcher relied on unreliable SDK-provided command identifiers rather than parsing the full command text. Fixed by matching against parsed pipeline segments of fullCommandText.

Proposed test

• Workflow file: test-copilot-sdk-create-pull-request.md
• Trigger: workflow_dispatch
• Engine: copilot with copilot-sdk: true (see test-copilot-inline-sub-agents.md for the frontmatter shape)
• Safe output: create-pull-request
• Variant: standard

Minimal test prompt sketch

Ask the agent to create a new branch, add/modify a file, and open a pull request via create-pull-request — the same kind of git-subcommand sequence (git checkout -b, git branch, etc.) that the auto-granted shell rules must permit. With copilot-sdk: true set, this exercises the SDK's permission-matching path specifically, which differs from the default Copilot driver.

New fixtures or secrets needed

None.

Notes

Open suggestion #10151 ("engine-copilot-sdk-mode") covers general SDK-mode enablement but not this specific git-permission-matching regression. No existing test combines copilot-sdk: true with create-pull-request. Distinct and narrower scope from #10151.

Generated by 🔍 Suggest New E2E Tests · copilot · auto · 115.7 AIC · ⌖ 5.86 AIC · ⊞ 7.9K · ◷