fix(aw): resolve jp-sync changed files via the GitHub MCP server

[ChronosSF]

Problem

Both JP sync agents are told to find the pushed changeset with:

git diff --name-only HEAD~1 HEAD -- docs/<set>/src/content/en/

but the compiled workflows check the repo out with fetch-depth: 1. In a single-commit shallow clone HEAD~1 does not exist, so that command fails. The documented fallback, git log --name-only --format="" -1, does not degrade gracefully either — on a merge commit it lists the entire en/ tree rather than a changeset.

What that cost us

When the QR Code docs merged to vnext (#837, e0c49ec), the xplat sync run 36129656534 hit exactly this and gave up, reporting a noop:

the checkout is a shallow clone with only one commit (e0c49ec), so no real parent commit exists to diff against. git diff HEAD~1 HEAD fails, and git log --name-only -1 just lists the entire en/ tree (285 files) rather than a genuine changeset. […] Since I can't reliably determine which files actually changed, I did not translate or open a PR to avoid mis-scoping the sync.

Because safe-outputs.create-pull-request.if-no-changes: ignore is set and noop is a legitimate safe-output, the run was reported green. The skip was indistinguishable from "nothing to do."

Meanwhile the Angular agent (run 36129656538) improvised around the same shallow clone by querying the GitHub MCP server, and correctly found that the only tracked change under docs/angular/src/content/en/ was a new TOC entry. It shipped that entry — #858 — for a page the xplat sync had just silently failed to translate. The result is a JP TOC href with no page behind it, which fails check-relative-links.

This class of miss has bitten us before: 1780f11c34 was a manual replay of failed Angular + xplat JP syncs for four EN PRs.

Change

Step 1 in both agent prompts now resolves the changeset through the read-only github MCP CLI, which is already mounted and allow-listed in the compiled workflows:

• github get_commit --owner … --sha <sha> — for a merge commit GitHub returns the diff against the first parent, which is precisely what the merge brought onto vnext.
• github get_pull_request_files --owner … --pullNumber NNN when the push was a PR merge. Preferred for merges, and required past 300 changed files, since GitHub truncates a commit's files array at 300 entries.

Local git is now used only for the HEAD SHA, which a shallow clone does provide.

Step 3 reads each file's patch from that same response, falling back to cat on the working tree (which sits at the pushed commit) when GitHub omits the patch for a large or newly added file.

Two guardrails against silent misses:

• The agents are told explicitly not to fall back to git diff HEAD~1 HEAD or git log --name-only -1, and not to emit noop merely because local git could not produce a diff.
• If the MCP calls themselves fail, they emit report_incomplete rather than noop, so the failure surfaces instead of passing as a clean run.

Author attribution now prefers the commit/PR author from the MCP response — on a merge commit the local committer is whoever pressed merge, not the person who wrote the docs.

The SECURITY block is updated to list the read-only github MCP CLI among the permitted actions, so the agent doesn't read it as off-limits.

Notes for review

• No frontmatter change: the github MCP server and shell(github:*) were already available to both agents — the Angular agent used them unprompted. frontmatter_hash is unchanged.
• Lock files are recompiled with the same gh aw v0.88.7 that produced them. The prompt body is runtime-imported ({{#runtime-import …}}), so the only lock change is body_hash.
• Not addressed here: the Angular agent will still mirror a TOC entry whose JP target does not exist yet. That is benign once the xplat sync stops skipping, but a guard against dangling TOC hrefs would be a reasonable follow-up.
• The QR Code JP topic itself is handled separately, on [jp-sync] Sync JP TOC: add QR Code entry #858.

🤖 Generated with Claude Code