[Safe Outputs Conformance] USE-001: Standardize error codes across 4 safe-output handlers

[github-actions]

Conformance Check Failure

Check ID: USE-001
Severity: LOW (4 occurrences, grouped)
Category: Usability (Error Code Standardization)

Problem Description

The USE-001 conformance check flags four safe-output handlers that throw errors (throw new Error(...) / core.setFailed) without using the repository-standard EXXX: error-code prefix. The convention is already established elsewhere in the codebase (for example assign_to_agent.cjs uses E004:, comment_limit_helpers.cjs uses E006/E007/E008, comment_memory.cjs uses E001, dispatch_repository.cjs uses E002). Standardized codes make errors greppable, documentable, and consistent for downstream tooling and users.

These are LOW severity and individually minor, but they share one root cause and one clean fix, so they are grouped here.

Affected Components

Each handler throws plain (uncoded) errors:

• actions/setup/js/add_reviewer.cjs — e.g. line 216 Could not resolve pull request node ID ...
• actions/setup/js/apply_samples.cjs — e.g. lines 62/71/75/78 JSON parsing & validation errors
• actions/setup/js/hide_comment.cjs — e.g. lines 56/68/72/83 comment_id validation/resolution errors
• actions/setup/js/safeoutputs_cli.cjs — e.g. lines 33/45 invalid argument / tool-invocation failures

Current vs Expected Behavior

Current Behavior

Errors are thrown as free-text messages with no EXXX: prefix, e.g.:

throw new Error("comment_id is required");
throw new Error(`apply_samples: GH_AW_SAMPLES must be a JSON array`);

The USE-001 check (grep -qE "E[0-9]{3}|ERROR_|ERR_") finds no standardized code and reports LOW.

Expected Behavior

Thrown/failed errors carry a standardized code prefix consistent with the existing scheme, e.g.:

throw new Error(`E0NN: comment_id is required`);

Remediation Steps

This task can be assigned to a Copilot coding agent:

1. Survey the currently-used error codes (E000-E008, E099 are already taken) and allocate new codes for each handlers distinct failure classes, following the existing numbering scheme. Avoid collisions.
2. Prefix the throw new Error(...) / core.setFailed(...) messages in the four handlers with the allocated EXXX: codes. Keep the human-readable remainder of each message intact.
3. If a central error-code registry/doc exists, add the new codes there for discoverability.
4. Re-run the conformance checker and confirm USE-001 passes for all four handlers.

Verification

After remediation, verify the fix by running:

bash scripts/check-safe-outputs-conformance.sh

The USE-001 check should report no flagged handlers.

References

• Safe Outputs Specification: docs/src/content/docs/specs/safe-outputs-specification.md
• Conformance Checker: scripts/check-safe-outputs-conformance.sh (check_error_codes, lines 195-224)
• Existing examples: actions/setup/js/comment_limit_helpers.cjs (E006-E008), actions/setup/js/assign_to_agent.cjs (E004)
• Run ID: 27085521200
• Date: 2026-06-07

Generated by ✅ Daily Safe Outputs Conformance Checker · 58.2 AIC · ⌖ 12.8 AIC · ⊞ 6.7K · ◷

• expires on Jun 8, 2026, 7:04 AM UTC