From 51f7e65c04b9746e987242d5f272e9183ab1bf6e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 19 Jul 2026 07:12:22 +0000
Subject: [PATCH 1/3] Initial plan


From 3a9b6c31fabe963cf371fe3a69d100e4230e0da9 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 19 Jul 2026 07:24:41 +0000
Subject: [PATCH 2/3] fix(USE-001): standardize error codes across 4
 safe-output handlers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add ERR_SYSTEM/ERR_CONFIG prefixes to all throw new Error() calls in:
- create_code_scanning_alert.cjs (file write I/O)
- load_experiment_state_from_repo.cjs (directory/file I/O)
- safe_outputs_bootstrap.cjs (policy enforcement → ERR_CONFIG)
- safe_outputs_config.cjs (directory creation I/O)

Fixes #46550

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 actions/setup/js/create_code_scanning_alert.cjs      | 3 ++-
 actions/setup/js/load_experiment_state_from_repo.cjs | 7 ++++---
 actions/setup/js/safe_outputs_bootstrap.cjs          | 3 ++-
 actions/setup/js/safe_outputs_config.cjs             | 3 ++-
 4 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/actions/setup/js/create_code_scanning_alert.cjs b/actions/setup/js/create_code_scanning_alert.cjs
index e93c6e7fc9f..2ed6f4663ae 100644
--- a/actions/setup/js/create_code_scanning_alert.cjs
+++ b/actions/setup/js/create_code_scanning_alert.cjs
@@ -8,6 +8,7 @@
 const { getErrorMessage } = require("./error_helpers.cjs");
 const { logStagedPreviewInfo } = require("./staged_preview.cjs");
 const { isStagedMode } = require("./safe_output_helpers.cjs");
+const { ERR_SYSTEM } = require("./error_codes.cjs");
 const fs = require("fs");
 const path = require("path");
 
@@ -89,7 +90,7 @@ async function main(config = {}) {
     try {
       fs.writeFileSync(sarifFilePath, JSON.stringify(sarifContent, null, 2));
     } catch (err) {
-      throw new Error(`Failed to write file ${sarifFilePath}: ${String(err)}`, { cause: err });
+      throw new Error(`${ERR_SYSTEM}: Failed to write file ${sarifFilePath}: ${String(err)}`, { cause: err });
     }
     core.info(`✓ Updated SARIF file with ${validFindings.length} finding(s): ${sarifFilePath}`);
   }
diff --git a/actions/setup/js/load_experiment_state_from_repo.cjs b/actions/setup/js/load_experiment_state_from_repo.cjs
index d73cc234ac7..82b430f46cb 100644
--- a/actions/setup/js/load_experiment_state_from_repo.cjs
+++ b/actions/setup/js/load_experiment_state_from_repo.cjs
@@ -22,6 +22,7 @@
 const fs = require("fs");
 const path = require("path");
 const { getErrorMessage } = require("./error_helpers.cjs");
+const { ERR_SYSTEM } = require("./error_codes.cjs");
 
 const MAX_STATE_FILE_BYTES = 102400;
 // Keep this allowlist aligned with actions/setup/js/normalize_branch_name.cjs valid characters.
@@ -119,7 +120,7 @@ async function main() {
     try {
       fs.mkdirSync(stateDir, { recursive: true });
     } catch (err) {
-      throw new Error(`Failed to create directory ${stateDir}: ${String(err)}`, { cause: err });
+      throw new Error(`${ERR_SYSTEM}: Failed to create directory ${stateDir}: ${String(err)}`, { cause: err });
     }
     return;
   }
@@ -143,7 +144,7 @@ async function main() {
   try {
     fs.mkdirSync(stateDir, { recursive: true });
   } catch (err) {
-    throw new Error(`Failed to create directory ${stateDir}: ${String(err)}`, { cause: err });
+    throw new Error(`${ERR_SYSTEM}: Failed to create directory ${stateDir}: ${String(err)}`, { cause: err });
   }
 
   if (content === null) {
@@ -171,7 +172,7 @@ async function main() {
   try {
     fs.writeFileSync(stateFile, content, "utf8");
   } catch (err) {
-    throw new Error(`Failed to write file ${stateFile}: ${String(err)}`, { cause: err });
+    throw new Error(`${ERR_SYSTEM}: Failed to write file ${stateFile}: ${String(err)}`, { cause: err });
   }
   core.info(`Experiment state written to ${stateFile}`);
 }
diff --git a/actions/setup/js/safe_outputs_bootstrap.cjs b/actions/setup/js/safe_outputs_bootstrap.cjs
index 86803dfef12..f60315d9c87 100644
--- a/actions/setup/js/safe_outputs_bootstrap.cjs
+++ b/actions/setup/js/safe_outputs_bootstrap.cjs
@@ -15,6 +15,7 @@
 const fs = require("fs");
 const { loadConfig } = require("./safe_outputs_config.cjs");
 const { loadTools } = require("./safe_outputs_tools_loader.cjs");
+const { ERR_CONFIG } = require("./error_codes.cjs");
 
 /**
  * @typedef {Object} Logger
@@ -68,7 +69,7 @@ function enforceCreatePullRequestRuntimePolicy(config, logger) {
 
   const message = `create-pull-request is disabled by runtime policy: ${policyVarName}=false. ` + `Remove safe-outputs.create-pull-request or set ${policyVarName}=true.`;
   logger.debugError(message);
-  throw new Error(message);
+  throw new Error(`${ERR_CONFIG}: ${message}`);
 }
 
 /**
diff --git a/actions/setup/js/safe_outputs_config.cjs b/actions/setup/js/safe_outputs_config.cjs
index b50eba4f2a9..b6423999a54 100644
--- a/actions/setup/js/safe_outputs_config.cjs
+++ b/actions/setup/js/safe_outputs_config.cjs
@@ -2,6 +2,7 @@
 
 const { getErrorMessage } = require("./error_helpers.cjs");
 const { redactSensitiveConfig } = require("./safe_outputs_config_redact.cjs");
+const { ERR_SYSTEM } = require("./error_codes.cjs");
 
 const fs = require("fs");
 const path = require("path");
@@ -73,7 +74,7 @@ function loadConfig(server) {
     try {
       fs.mkdirSync(outputDir, { recursive: true });
     } catch (err) {
-      throw new Error(`Failed to create directory ${outputDir}: ${String(err)}`, { cause: err });
+      throw new Error(`${ERR_SYSTEM}: Failed to create directory ${outputDir}: ${String(err)}`, { cause: err });
     }
   }
 

From 5ab987d8f1a6e3e8bafd1cdd21f3d61c2c885170 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 19 Jul 2026 10:14:32 +0000
Subject: [PATCH 3/3] fix(USE-001): wrap non-404 API error in
 fetchFileFromBranch with ERR_API prefix

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 actions/setup/js/load_experiment_state_from_repo.cjs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/actions/setup/js/load_experiment_state_from_repo.cjs b/actions/setup/js/load_experiment_state_from_repo.cjs
index 82b430f46cb..8e6b3476c9c 100644
--- a/actions/setup/js/load_experiment_state_from_repo.cjs
+++ b/actions/setup/js/load_experiment_state_from_repo.cjs
@@ -22,7 +22,7 @@
 const fs = require("fs");
 const path = require("path");
 const { getErrorMessage } = require("./error_helpers.cjs");
-const { ERR_SYSTEM } = require("./error_codes.cjs");
+const { ERR_SYSTEM, ERR_API } = require("./error_codes.cjs");
 
 const MAX_STATE_FILE_BYTES = 102400;
 // Keep this allowlist aligned with actions/setup/js/normalize_branch_name.cjs valid characters.
@@ -100,7 +100,7 @@ async function fetchFileFromBranch(octokit, owner, repo, branch, filePath) {
     if (errAny.status === 404) {
       return null;
     }
-    throw err;
+    throw new Error(`${ERR_API}: Failed to fetch file "${filePath}" from branch "${branch}": ${String(err)}`, { cause: err });
   }
 }