apply_samples.cjs ignores target-repo when fetching PR for push_to_pull_request_branch samples in siderepo workflows

[dsyme]

Summary

Two siderepo push-to-PR-branch workflow-dispatch tests in githubnext/gh-aw-test fail persistently on every matrix run (failing since run 27847637501):

• test-copilot-siderepo-push-to-pull-request-branch-using-dispatch
• test-copilot-siderepo-sparse-push-to-pull-request-branch-using-dispatch

Failing in all four matrix entries (main/samples=true, main/samples=false, pre-release, release). Previous issues #37546 and #37545 were closed but the bug persists.

---

Root cause — non-sparse variant

Run: 28080402724

The test creates a PR in githubnext/gh-aw-side-repo (not the host repo githubnext/gh-aw-test). The e2e harness dispatches the workflow with pull_request_number=447 as an input. The lockfile's GH_AW_SAMPLES env var correctly resolves to:

[{
  "tool": "push_to_pull_request_branch",
  "arguments": {
    "message": "Multi-commit test push from Copilot in side repo",
    "pull_request_number": "447"
  },
  "sidecars": { "patch": "..." }
}]

But apply_samples.cjs then fetches:

[warning] apply_samples: GET https://api.github.com/repos/githubnext/gh-aw-test/pulls/447 returned HTTP 404
[error] Error: apply_samples: cannot derive pull-request head branch for sample[0] (tool=push_to_pull_request_branch).
  Trigger the workflow from a pull_request event, or set arguments.pull_request_number on the sample entry,
  or provide GITHUB_TOKEN so the PR can be fetched.
    at preStagePatch (apply_samples.cjs:361:13)
    at async main (apply_samples.cjs:542:7)

It fetches PR #447 from GITHUB_REPOSITORY (githubnext/gh-aw-test) instead of the side-repo (githubnext/gh-aw-side-repo).

The GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG (set in the safe_outputs job) does correctly contain "target": "447", "target-repo": "githubnext/gh-aw-side-repo". The config file at GH_AW_SAFE_OUTPUTS_CONFIG_PATH (which the agent job reads) also has "target": "${GH_AW_INPUT_PULL_REQUEST_NUMBER}", "target-repo": "githubnext/gh-aw-side-repo" — but apply_samples.cjs does not use this information when deriving the PR branch.

Note: GITHUB_TOKEN is present, and GH_AW_REPO_TOKENS includes {"githubnext/gh-aw-side-repo": "***"}. The issue is purely that apply_samples.cjs constructs the PR fetch URL from GITHUB_REPOSITORY only, ignoring target-repo.

---

Root cause — sparse variant

Run: 28080402587

Different failure mode: apply_samples.cjs succeeds ("1 sample(s) replayed successfully"), but the safe_outputs job fails with:

##[error] Cannot push to pull request branch: patch modifies protected files (README.md).
Add them to the allowed-files configuration field or set protected-files: fallback-to-issue
to create a review issue instead.

The sparse sample's patch only touches src/sparse-test.py, not README.md. This is unexpected. Possible causes:

• The test-PR branch in the side repo has accumulated a README.md diff from a stale previous run, and the protected-files check evaluates the full PR diff (not just the incoming patch).
• Or apply_samples.cjs is emitting a different patch than intended.

---

Suggested fix (non-sparse)

When apply_samples.cjs processes a push_to_pull_request_branch sample and needs to fetch the PR head branch, it should use target-repo from the safe-outputs config (available in the config file at GH_AW_SAFE_OUTPUTS_CONFIG_PATH) rather than always using GITHUB_REPOSITORY. As a fallback, it could also try repos listed in GH_AW_REPO_TOKENS when the primary fetch returns 404.