[aw-compat] Missing codemod: safe-outputs add-pr-comment -> add-comment (fix should apply compiler suggestion)

[github-actions]

Missing codemod: safe-outputs.add-pr-comment → add-comment

The daily cross-repo compilation audit (20 top lock-file adopters, ranked by stars, compiled with gh-aw afad433) surfaced one genuine compile failure that gh aw fix --write does not heal — even though the compiler already computes the exact fix.

Key finding

ms-mfg-community/day-in-the-life-copilot-lab → .github/workflows/code-review.md uses the retired safe-output key add-pr-comment. It fails compilation in both strict and default modes:

.github/workflows/code-review.md:17:3: error: Unknown property: add-pr-comment. Did you mean 'add-comment'?

The compiler already emits the correct suggestion (add-comment), but gh aw fix --write leaves the key untouched (it only converted permissions in the same repo). This is a high-value / low-effort codemod gap: the rename is deterministic and the target is already known to the validator.

Proposed remediation

Teach gh aw fix to apply the safe-output key rename add-pr-comment → add-comment (and, more generally, auto-apply the validator's own "Did you mean" suggestion for known-renamed safe-output keys). Offending frontmatter:

safe-outputs:
  add-pr-comment:      # -> add-comment
    labels: [ai-review]

Run metrics (20 repos, gh-aw afad433)

Class	Count	Notes
Clean / healed-by-fix	15	incl. gh aw fix migrations upload-assets→upload-asset, on.command→on.slash_command (working)
Strict-only (default passes)	4	by-design guards on gh-aw ecosystem test/dev repos
Genuine failure	1	add-pr-comment (this issue)

Strict-only signatures (default compile passes — by-design, not regressions)

• strict mode: 'sandbox.agent: false' is not allowed — elastic/ai-github-actions, githubnext/gh-aw-test
• strict mode: 'sandbox.mcp.version' is not allowed (internal detail) — github/gh-aw-firewall
• strict mode: 'sandbox.mcp.container' is not allowed (internal detail) + secrets-in-steps — github/gh-aw-mcpg

These are the gh-aw ecosystem's own test/dev repos intentionally exercising internal fields; all compile cleanly under default (non-strict) mode. No action needed.

Discovery note

GitHub code search was unavailable this run (HTTP 429 / HTML responses on every gh search code variant). Fell back to the cached adopter pool (20 repos), each re-verified public + non-archived via the REST repos API with refreshed star counts.

References:

• ms-mfg-community/day-in-the-life-copilot-lab · code-review.md
• pelikhan/github-agentic-workflows (reference: on.command/upload-assets codemods that do work)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• models.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "models.dev"

See Network Configuration for more information.

Generated by 🔧 Daily AW Cross-Repo Compile Check · 277 AIC · ⌖ 34.6 AIC · ⊞ 6.6K · ◷

• expires on Jul 14, 2026, 2:18 AM UTC-08:00