[nightly-fix-finder] Open fixes as pull requests

[jonathanpeppers]

---

The nightly fix finder currently creates an issue and hands it to Copilot using a team PAT, which adds an unnecessary issue-to-PR hop and gives the workflow another long-lived credential. This change has the scheduled agent implement and validate one selected finding directly, then open a review-ready PR through gh-aw safe outputs.

Repository writes remain isolated from the agent: gh-proxy is pinned to the read-only GITHUB_TOKEN, while the safe-output job creates the PR as github-actions[bot] and preserves the Copilot co-author trailer. Finding issues and fallback issues are disabled; expected no-op runs continue reporting to the shared no-op issue. The workflow is regenerated with gh-aw v0.85.4 so the conclusion job can receive the narrowly scoped issues: write permission required by no-op reporting.

• Useful description of why the change is necessary.
• Links to issues fixed: N/A; this is a workflow simplification without a source issue.
• Unit tests: N/A; the agentic workflow was compiled in strict mode and independently reviewed with Claude Opus 5.

[Copilot]

Pull request overview

This PR refactors the nightly-fix-finder agentic workflow to implement a selected finding directly and open a PR (instead of creating an issue + assigning Copilot), while also regenerating the compiled workflow lock file with gh-aw v0.85.4.

Changes:

• Switch safe-outputs from create_issue/assign_to_agent to create_pull_request, and adjust permissions/no-op reporting accordingly.
• Update fix-finder category guidance scripts to reflect “make a fix PR” rather than “file an issue”.
• Regenerate .github/workflows/nightly-fix-finder.lock.yml and update .github/aw/actions-lock.json.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/nightly-fix-finder.md	Updates workflow frontmatter + agent prompt to implement/validate a fix and open a PR; adjusts permissions and safe-outputs configuration.
.github/workflows/nightly-fix-finder.lock.yml	Regenerated compiled workflow for gh-aw v0.85.4; includes updated safe-output tooling and CLI proxy flow.
.github/aw/actions-lock.json	Updates pinned gh-aw action entries (but currently drops setup-cli, which is still referenced elsewhere).
.github/workflows/nightly-fix-finder/00-todo-fixme-hack.sh	Guidance updated to reference PRs instead of issues.
.github/workflows/nightly-fix-finder/01-nullable-reference-types.sh	Guidance updated to “do not open a PR for a test file” (vs filing issues).
.github/workflows/nightly-fix-finder/02-null-forgiving-operator.sh	Guidance updated to “verify before changing it” wording.
.github/workflows/nightly-fix-finder/03-region-directives.sh	Guidance updated to “verify before changing it” wording.
.github/workflows/nightly-fix-finder/05-general-mistakes.sh	Guidance updated from “file an issue” to “implement the smallest fix + regression test when practical”.
.github/workflows/nightly-fix-finder/06-unused-using-directives.sh	Guidance updated to “confirm before changing it” wording.
.github/workflows/nightly-fix-finder/07-asynctask-log-property.sh	Guidance updated to “verify before changing it” wording.
.github/workflows/nightly-fix-finder/08-string-literal-error-messages.sh	Updates guidance to avoid adding new resources (and instead noop if no suitable existing resource exists).

Suppressed comments (1)

.github/workflows/nightly-fix-finder.md:132

• ⚠️ warning: The agent now has an unrestricted shell tool allowlist (bash: ["*"]), which is a significant permissions broadening compared to enumerating only the commands needed for scanning/building. Even with repo writes isolated, least-privilege here helps reduce accidental destructive commands and narrows the audit surface.

        needs.pat_pool.outputs.pat_number == '8', secrets.COPILOT_PAT_8,
        needs.pat_pool.outputs.pat_number == '9', secrets.COPILOT_PAT_9,
        'NO COPILOT PAT AVAILABLE')
      }}

[jonathanpeppers]

Looks like we have to merge to test this: