Address typed output compatibility gaps

[kerobbi]

Summary

Addresses compatibility and output-contract gaps found during final review of the typed-output stack. Existing tools keep their intended input behavior while modern clients receive more complete, accurately validated structured results.

Why

The typed-output stack adds structured contracts across existing tools for Code Mode and compound tool use. This follow-up keeps those contracts aligned with runtime behavior before release, without adding tools, scopes, or API calls.

Fixes N/A - follow-up to the stack ending at #3403.

What changed

• Preserves legacy-compatible inputs and missing-versus-empty semantics across issue, pull request, commit, repository, gist, and duplicate-search tools.
• Retains fields needed to interpret security alerts, notifications, rule suites, repository projections, reactions, and Copilot assignments.
• Tightens method-tagged Actions and ui_get schemas, restricts unused Project user fields, and runs the bundled App parser tests through the UI build check.

MCP impact

• No tool or API changes
• Tool schema or behavior changed - corrects existing input/output contracts for typed tools. Tool names, scopes, endpoints, and protocol gating are unchanged.
• New tool added

Modern clients receive corrected structured fields and stricter method/payload schemas. Legacy clients retain established handler behavior, including compatibility inputs that typed validation previously rejected.

Prompts tested (tool changes only)

• Automated equivalents of “Find duplicate issues” and repository/issue/PR reads using legacy-compatible pagination, null, zero, and ignored parameters.
• Security, notification, gist, governance, reaction, and Copilot reads with the fields needed to interpret or continue the result.
• Actions and ui_get calls across valid, missing, mismatched, and multiple method payloads, plus legacy and modern bundled App parsing.

Security / limits

• No security or limits impact
• Auth / permissions considered - existing scopes, authorization checks, endpoints, and feature gates are unchanged.
• Data exposure, filtering, or token/size limits considered - adds only selected canonical/recovery fields from existing authorized responses, removes unused Project user details from schemas, and applies the existing commit-content IFC label to blame output.

No dependency manifests or lockfiles changed. Existing UI dependency audit findings are unchanged and outside this follow-up.

Tool renaming

• I am renaming tools as part of this PR (e.g. a part of a consolidation effort)
  • I have added the new tool aliases in deprecated_tool_aliases.go
• I am not renaming tools as part of this PR

Note: if you're renaming tools, you must add the tool aliases. For more information, see the tool renaming documentation.

Lint & tests

• Linted locally with ./script/lint - passed with 0 issues.
• Tested locally with ./script/test - passed with the full race-enabled suite.

Additional validation:

• UPDATE_TOOLSNAPS=true go test ./... - passed.
• script/generate-docs - passed.
• npm --prefix ui test - passed, 11/11.
• npm --prefix ui run typecheck - passed.
• npm --prefix ui run build - passed.
• go build ./cmd/github-mcp-server ./cmd/mcpcurl - passed.
• git diff --check - passed.

Docs

• Not needed
• Updated (README / docs / examples) - updated generated tool documentation, feature-flag documentation, and intentional tool schema snapshots.

[Copilot]

Copilot review overview

🟡 Changes recommended

Output contracts still have nullability and documentation gaps, and CWE fallback projection can mutate aliased input storage.

Review effort: Balanced
Findings: 2 · 1

Open (3)

• Require non-null payloads for required Actions responses · New
• Avoid mutating aliased CWEIDs backing storage · New
• Update fields documentation for omitted API URLs · New

What changed in this PR

Improves typed-output compatibility while preserving legacy behavior across GitHub tools.

Changes:

• Restores compatibility for legacy inputs and missing-versus-empty values.
• Expands structured outputs and tightens method-specific schemas.
• Adds contract tests, snapshots, documentation, and UI parser validation.

File	Description
script/​build-ui	Runs UI tests before building.
README.md	Clarifies repository-search output behavior.
pkg/​github/​typed_security_outputs_test.go	Tests added security fields.
pkg/​github/​typed_search_outputs_test.go	Tests empty field-value preservation.
pkg/​github/​typed_repository_outputs_test.go	Tests projected repository URLs.
pkg/​github/​typed_granular_pull_request_outputs_test.go	Updates reaction contracts and pagination expectations.
pkg/​github/​typed_governance_outputs.go	Preserves rule-suite fields and nullable source IDs.
pkg/​github/​typed_governance_outputs_test.go	Tests rule-suite fidelity.
pkg/​github/​typed_git_gist_outputs_test.go	Tests gist recovery URLs.
pkg/​github/​typed_copilot_ui_outputs.go	Adds canonical URLs and UI method constraints.
pkg/​github/​typed_copilot_ui_outputs_test.go	Tests Copilot URLs and UI discriminators.
pkg/​github/​typed_contracts_test.go	Adds Actions, UI, and Projects contract tests.
pkg/​github/​typed_compatibility_test.go	Adds cross-protocol compatibility coverage.
pkg/​github/​typed_actions_outputs_test.go	Verifies method-specific Actions schemas.
pkg/​github/​security_outputs.go	Adds security-alert fidelity fields.
pkg/​github/​search.go	Clarifies repository search projection behavior.
pkg/​github/​repository_tool_types.go	Adds selectable directory API URLs.
pkg/​github/​repositories.go	Relaxes pagination, preserves projections, and labels blame output.
pkg/​github/​pullrequests_granular.go	Aligns reaction text and structured output.
pkg/​github/​projects_types.go	Removes unused user details from project schemas.
pkg/​github/​notification_output_fidelity_test.go	Tests notification field fidelity.
pkg/​github/​method_output_schema.go	Adds shared method/payload schema constraints.
pkg/​github/​issues.go	Preserves present empty field-value arrays.
pkg/​github/​issues_granular.go	Applies compatibility error normalization.
pkg/​github/​granular_pull_request_types.go	Aligns reaction output with minimal responses.
pkg/​github/​granular_issue_types.go	Normalizes zero IDs and input diagnostics.
pkg/​github/​git_gist_types.go	Retains gist recovery URLs.
pkg/​github/​find_duplicate.go	Advertises zero pagination compatibility.
pkg/​github/​find_duplicate_test.go	Tests duplicate-search pagination contracts.
pkg/​github/​discussion_notification_outputs.go	Preserves provider notification values and subject URLs.
pkg/​github/​discussion_notification_contracts_test.go	Tests notification schema changes.
pkg/​github/​copilot.go	Returns canonical issue and pull-request URLs.
pkg/​github/​consolidated_pull_request_types.go	Restricts cursor handling to review comments.
pkg/​github/​actions_types.go	Adds method-tagged Actions output constraints.
pkg/​github/​__toolsnaps__/​ui_get.snap	Updates UI output schema snapshot.
pkg/​github/​__toolsnaps__/​search_repositories.snap	Updates search description snapshot.
pkg/​github/​__toolsnaps__/​repository_ruleset_read.snap	Updates rule-suite snapshot.
pkg/​github/​__toolsnaps__/​projects_write.snap	Removes project user details.
pkg/​github/​__toolsnaps__/​projects_list.snap	Removes project user details.
pkg/​github/​__toolsnaps__/​projects_get.snap	Removes project user details.
pkg/​github/​__toolsnaps__/​list_secret_scanning_alerts.snap	Adds secret qualifiers.
pkg/​github/​__toolsnaps__/​list_notifications.snap	Updates notification contract.
pkg/​github/​__toolsnaps__/​list_gists.snap	Adds gist recovery URLs.
pkg/​github/​__toolsnaps__/​list_dependabot_alerts.snap	Adds advisory classification.
pkg/​github/​__toolsnaps__/​get_secret_scanning_alert.snap	Adds secret qualifiers.
pkg/​github/​__toolsnaps__/​get_notification_details.snap	Updates notification contract.
pkg/​github/​__toolsnaps__/​get_gist.snap	Adds gist recovery URLs.
pkg/​github/​__toolsnaps__/​get_file_contents.snap	Adds selectable API URLs.
pkg/​github/​__toolsnaps__/​get_dependabot_alert.snap	Adds advisory classification.
pkg/​github/​__toolsnaps__/​find_duplicate_ff_duplicate_detection.snap	Updates pagination bounds.
pkg/​github/​__toolsnaps__/​assign_copilot_to_issue.snap	Adds canonical URLs.
pkg/​github/​__toolsnaps__/​assign_copilot_to_issue_with_intent.snap	Adds canonical URLs.
pkg/​github/​__toolsnaps__/​add_pull_request_review_comment_reaction.snap	Updates reaction output.
pkg/​github/​__toolsnaps__/​actions_run_trigger.snap	Adds trigger-method constraints.
pkg/​github/​__toolsnaps__/​actions_list.snap	Adds list-method constraints.
pkg/​github/​__toolsnaps__/​actions_get.snap	Adds get-method constraints.
docs/​feature-flags.md	Documents duplicate-search pagination.
.github/​actions/​build-ui/​action.yml	Invalidates and labels tested UI caches.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Its broad cross-tool protocol and schema changes warrant final human validation despite no confirmed defects.

Review effort: Balanced
Findings: None

Resolved since last review (3)

• Avoid mutating aliased CWEIDs backing storage
• Require non-null payloads for required Actions responses
• Update fields documentation for omitted API URLs