Add daily Linear and Jira smoke issues workflow

.github/aw/safe-outputs-content.md

@@ -41,6 +41,7 @@ description: Safe-output reference for issue, discussion, comment, and pull requ
     linear-create-issue:
       max: 1
       team-id: "TEAM_ID"
+      project-id: "PROJECT_ID"
     linear-add-comment:
       max: 1
     linear-update-issue:
@@ -51,11 +52,11 @@ description: Safe-output reference for issue, discussion, comment, and pull requ
 
   | Frontmatter | Tool | Agent inputs |
   |---|---|---|
-  | `linear-create-issue` | `linear_create_issue` | `title`, `body` (team taken from config `team-id`) |
+  | `linear-create-issue` | `linear_create_issue` | `title`, `body` (team and optional project taken from config) |
   | `linear-add-comment` | `linear_add_comment` | `body` (target issue) |
   | `linear-update-issue` | `linear_update_issue` | `title`/`body`, gated by the matching `title:`/`body:` config flags |
 
-  `linear-token:` is a top-level `safe-outputs:` field, not nested under `env:`. Each output supports `max` and `staged`. Only fields explicitly enabled in `update-issue` config (`title`, `body`) can be changed by the agent.
+  `linear-token:` is a top-level `safe-outputs:` field, not nested under `env:`. `linear-create-issue.project-id` optionally fixes created issues to a trusted Linear project identifier from its URL or model UUID. Each output supports `max` and `staged`. Only fields explicitly enabled in `update-issue` config (`title`, `body`) can be changed by the agent.
 
 - **[Experimental]** Azure DevOps work-item operations are namespaced `ado-*` and rely on an Azure DevOps MCP server (configured separately under `mcp-servers:`/`tools:`) for the underlying connection and credentials:
 

.github/workflows/smoke-issues.md

@@ -0,0 +1,40 @@
+---
+private: true
+emoji: "🧪"
+name: Smoke Issues
+description: Create a daily haiku issue in Linear and Jira through safe outputs
+on:
+  schedule: daily
+  workflow_dispatch:
+permissions:
+  contents: read
+  actions: read
+engine: copilot
+safe-outputs:
+  env:
+    JIRA_BASE_URL: https://pelidehalleux.atlassian.net
+    JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
+    JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+  linear-token: ${{ secrets.LINEAR_API_KEY }}
+  linear-create-issue:
+    team-id: "9cfb482a-81e3-4154-b5b9-2c805e70a02d"
+    project-id: "810f57a7e383"
+    max: 1
+  jira-create-issue:
+    max: 1
+timeout-minutes: 5
+---
+
+# Smoke Issues
+
+Generate one original haiku about code, automation, or workflows using a 5-7-5 syllable pattern.
+
+Create exactly two issues containing the same haiku and the workflow run URL:
+
+1. Use `linear_create_issue` to create one issue in the configured Linear project.
+2. Use `jira_create_issue` to create one `Task` in Jira project `KAN`.
+
+Use `Smoke Issues — ${{ github.run_id }}` as both issue titles. Include this run URL in both issue bodies:
+`${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}`.
+
+Do not create GitHub issues or use any other write tools.

actions/setup/js/linear_create_issue.cjs

@@ -8,6 +8,9 @@ const { isStagedMode } = require("./safe_output_helpers.cjs");
 const { logStagedPreviewInfo } = require("./staged_preview.cjs");
 const { ERR_API, ERR_CONFIG, ERR_VALIDATION } = require("./error_codes.cjs");
 
+const LINEAR_UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const LINEAR_PROJECT_ID_PATTERN = /^(?:[0-9a-f]{12}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
+
 const LINEAR_CREATE_ISSUE = `mutation LinearCreateIssue($input: IssueCreateInput!) {
   issueCreate(input: $input) {
     success
@@ -21,9 +24,13 @@ const LINEAR_CREATE_ISSUE = `mutation LinearCreateIssue($input: IssueCreateInput
 
 async function main(config = {}) {
   const teamId = config.team_id;
-  if (typeof teamId !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(teamId)) {
+  if (typeof teamId !== "string" || !LINEAR_UUID_PATTERN.test(teamId)) {
     throw new Error(`${ERR_CONFIG}: linear_create_issue requires a valid configured team ID`);
   }
+  const projectId = config.project_id;
+  if (projectId !== undefined && (typeof projectId !== "string" || !LINEAR_PROJECT_ID_PATTERN.test(projectId))) {
+    throw new Error(`${ERR_CONFIG}: linear_create_issue requires a valid configured project ID`);
+  }
 
   return async function handleLinearCreateIssue(item) {
     if (typeof item?.title !== "string" || !item.title.trim()) {
@@ -47,9 +54,11 @@ async function main(config = {}) {
       return { success: true, staged: true, title };
     }
 
-    const data = await linearGraphQL(LINEAR_CREATE_ISSUE, {
-      input: { teamId, title, description },
-    });
+    const input = { teamId, title, description };
+    if (projectId) {
+      input.projectId = projectId;
+    }
+    const data = await linearGraphQL(LINEAR_CREATE_ISSUE, { input });
     const payload = data?.issueCreate;
     if (payload?.success !== true || !payload.issue) {
       throw new Error(`${ERR_API}: Linear issueCreate did not return a successful issue`);

actions/setup/js/linear_safe_outputs.test.cjs

@@ -31,7 +31,7 @@ describe("Linear safe outputs", () => {
 
   it("posts fixed GraphQL documents with variables and raw API-key authorization", async () => {
     fetch.mockResolvedValue(response({ data: { issueCreate: { success: true, issue: { id: "id", identifier: "ENG-1", title: "Safe title" } } } }));
-    const handler = await createIssue({ team_id: "9cfb482a-81e3-4154-b5b9-2c805e70a02d" });
+    const handler = await createIssue({ team_id: "9cfb482a-81e3-4154-b5b9-2c805e70a02d", project_id: "810f57a7e383" });
     await handler({ title: "Safe title", body: "Detailed hello to @user" });
 
     expect(fetch).toHaveBeenCalledWith(
@@ -46,6 +46,7 @@ describe("Linear safe outputs", () => {
     expect(request.query).not.toContain("Safe title");
     expect(request.variables.input).toEqual({
       teamId: "9cfb482a-81e3-4154-b5b9-2c805e70a02d",
+      projectId: "810f57a7e383",
       title: "Safe title",
       description: "Detailed hello to `@user`",
     });
@@ -78,6 +79,10 @@ describe("Linear safe outputs", () => {
     expect(fetch).not.toHaveBeenCalled();
   });
 
+  it("rejects malformed configured project IDs", async () => {
+    await expect(createIssue({ team_id: "9cfb482a-81e3-4154-b5b9-2c805e70a02d", project_id: "not-a-project" })).rejects.toThrow("valid configured project ID");
+  });
+
   it("rejects HTTP, malformed JSON, GraphQL, and unsuccessful mutation responses", async () => {
     fetch.mockResolvedValueOnce(response({}, 429));
     await expect(linearGraphQL("query Fixed { viewer { id } }", {})).rejects.toThrow("rate limit exceeded");

actions/setup/js/redact_secrets.cjs

@@ -75,6 +75,9 @@ const BUILT_IN_PATTERNS = [
 
   // Anthropic tokens
   { name: "Anthropic API Key", pattern: /sk-ant-api03-[a-zA-Z0-9_-]{95}/g },
+
+  // Linear tokens
+  { name: "Linear API Key", pattern: /lin_api_[0-9A-Za-z]{40}/g },
 ];
 
 /**

actions/setup/js/redact_secrets.test.cjs

@@ -434,6 +434,20 @@ describe("redact_secrets.cjs", () => {
         });
       });
 
+      describe("Linear tokens", () => {
+        it("should redact Linear API keys", async () => {
+          const testFile = path.join(tempDir, "test.txt");
+          const linearKey = "lin_api_" + "C".repeat(40);
+          fs.writeFileSync(testFile, `Linear Key: ${linearKey}`);
+          process.env.GH_AW_SECRET_NAMES = "";
+          const modifiedScript = redactScript.replace('findFiles("/tmp/gh-aw", targetExtensions)', `findFiles("${tempDir.replace(/\\/g, "\\\\")}", targetExtensions)`);
+          await eval(`(async () => { ${modifiedScript}; await main(); })()`);
+          const redacted = fs.readFileSync(testFile, "utf8");
+          expect(redacted).toBe("Linear Key: ***REDACTED***");
+          expect(mockCore.info).toHaveBeenCalledWith(expect.stringContaining("Linear API Key"));
+        });
+      });
+
       describe("combined built-in and custom secrets", () => {
         it("should redact both built-in patterns and custom secrets", async () => {
           const testFile = path.join(tempDir, "test.txt");

actions/setup/js/safe_outputs_tools.json

@@ -1,7 +1,7 @@
 [
   {
     "name": "linear_create_issue",
-    "description": "Use this to create an issue in the Linear team fixed by safe-outputs.linear-create-issue.team-id. The Linear credential and team ID are trusted workflow configuration and are not agent inputs.",
+    "description": "Use this to create an issue in the Linear team fixed by safe-outputs.linear-create-issue.team-id and optional project fixed by project-id. The Linear credential, team ID, and project ID are trusted workflow configuration and are not agent inputs.",
     "inputSchema": {
       "type": "object",
       "required": ["title", "body"],

docs/src/content/docs/reference/frontmatter-full.md

@@ -8718,6 +8718,10 @@ safe-outputs:
     # Trusted Linear team model UUID.
     team-id: "example-value"
 
+    # Optional trusted Linear project identifier from a project URL or model UUID.
+    # (optional)
+    project-id: "example-value"
+
     # Maximum number of Linear issues to create (default: 1).
     # (optional)
     # Accepted formats:

docs/src/content/docs/reference/safe-outputs.md

@@ -130,6 +130,7 @@ safe-outputs:
   linear-token: ${{ secrets.LINEAR_API_KEY }}
   linear-create-issue:
     team-id: "9cfb482a-81e3-4154-b5b9-2c805e70a02d"
+    project-id: "810f57a7e383"
     max: 1
   linear-add-comment:
     target: "ENG-123"
@@ -139,7 +140,7 @@ safe-outputs:
     body: true
 ```
 
-`team-id` is the Linear team model UUID, available through Linear's model UUID tooling or API. Comment and update targets are fixed trusted configuration and accept either a Linear issue model UUID or shorthand identifier such as `ENG-123`. Updates replace only the enabled `title` and `body` fields. All agent-provided titles, descriptions, and comments use standard Safe Outputs sanitization.
+`team-id` is the Linear team model UUID, available through Linear's model UUID tooling or API. Optional `project-id` fixes new issues to a trusted project and accepts either the 12-character identifier from a Linear project URL or its model UUID. Comment and update targets are fixed trusted configuration and accept either a Linear issue model UUID or shorthand identifier such as `ENG-123`. Updates replace only the enabled `title` and `body` fields. All agent-provided titles, descriptions, and comments use standard Safe Outputs sanitization.
 
 ### System Types (Auto-Enabled)
 

docs/src/content/docs/specs/safe-outputs-specification.md

@@ -2754,12 +2754,13 @@ This section provides complete definitions for all remaining safe output types.
 
 - `linear-token`: REQUIRED trusted secret expression containing a Linear personal API key
 - `linear-create-issue.team-id`: REQUIRED Linear team model UUID
+- `linear-create-issue.project-id`: OPTIONAL trusted Linear project URL identifier or model UUID
 - `linear-create-issue.max`: Operation limit (default: 1)
 - `linear-create-issue.staged`: Staged mode override
 
 **MCP Tool**: `linear_create_issue`
 
-The MCP input object MUST require `title` and `body`, MUST reject additional properties, and MUST limit them to 128 and 65,000 characters respectively. The body MUST contain at least 20 characters. The trusted team UUID and credential MUST NOT be MCP inputs.
+The MCP input object MUST require `title` and `body`, MUST reject additional properties, and MUST limit them to 128 and 65,000 characters respectively. The body MUST contain at least 20 characters. The trusted team UUID, optional project identifier, and credential MUST NOT be MCP inputs.
 
 **Operational Semantics**:
 

pkg/parser/schema_linear_safe_outputs_test.go

@@ -13,8 +13,9 @@ func TestMainWorkflowSchemaLinearSafeOutputs(t *testing.T) {
 		"safe-outputs": map[string]any{
 			"linear-token": "${{ secrets.LINEAR_API_KEY }}",
 			"linear-create-issue": map[string]any{
-				"team-id": "9cfb482a-81e3-4154-b5b9-2c805e70a02d",
-				"max":     1,
+				"team-id":    "9cfb482a-81e3-4154-b5b9-2c805e70a02d",
+				"project-id": "810f57a7e383",
+				"max":        1,
 			},
 			"linear-add-comment": map[string]any{
 				"target": "ENG-123",
@@ -47,6 +48,16 @@ func TestMainWorkflowSchemaLinearSafeOutputs(t *testing.T) {
 				"linear-create-issue": map[string]any{},
 			},
 		},
+		{
+			name: "malformed project ID",
+			safeOutputs: map[string]any{
+				"linear-token": "${{ secrets.LINEAR_API_KEY }}",
+				"linear-create-issue": map[string]any{
+					"team-id":    "9cfb482a-81e3-4154-b5b9-2c805e70a02d",
+					"project-id": "not-a-project",
+				},
+			},
+		},
 		{
 			name: "malformed target",
 			safeOutputs: map[string]any{

pkg/parser/schemas/main_workflow_schema.json

@@ -7623,6 +7623,11 @@
               "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
               "description": "Trusted Linear team model UUID."
             },
+            "project-id": {
+              "type": "string",
+              "pattern": "^(?:[0-9a-fA-F]{12}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$",
+              "description": "Optional trusted Linear project identifier from a project URL or model UUID."
+            },
             "max": {
               "oneOf": [
                 { "type": "integer", "minimum": 1, "maximum": 100 },

pkg/workflow/js/safe_outputs_tools.json

@@ -1,7 +1,7 @@
 [
   {
     "name": "linear_create_issue",
-    "description": "Use this to create an issue in the Linear team fixed by safe-outputs.linear-create-issue.team-id. The Linear credential and team ID are trusted workflow configuration and are not agent inputs.",
+    "description": "Use this to create an issue in the Linear team fixed by safe-outputs.linear-create-issue.team-id and optional project fixed by project-id. The Linear credential, team ID, and project ID are trusted workflow configuration and are not agent inputs.",
     "inputSchema": {
       "type": "object",
       "required": ["title", "body"],

pkg/workflow/linear_safe_outputs.go

@@ -11,6 +11,7 @@ var linearSafeOutputsLog = logger.New("workflow:linear_safe_outputs")
 type LinearCreateIssueConfig struct {
 	BaseSafeOutputConfig `yaml:",inline"`
 	TeamID               string `yaml:"team-id"`
+	ProjectID            string `yaml:"project-id,omitempty"`
 }
 
 type LinearTargetConfig struct {

pkg/workflow/linear_safe_outputs_test.go

@@ -17,7 +17,8 @@ func TestExtractLinearSafeOutputsConfig(t *testing.T) {
 		"safe-outputs": map[string]any{
 			"linear-token": "${{ secrets.LINEAR_API_KEY }}",
 			"linear-create-issue": map[string]any{
-				"team-id": "9cfb482a-81e3-4154-b5b9-2c805e70a02d",
+				"team-id":    "9cfb482a-81e3-4154-b5b9-2c805e70a02d",
+				"project-id": "810f57a7e383",
 			},
 			"linear-add-comment": map[string]any{
 				"target": "ENG-123",
@@ -33,6 +34,7 @@ func TestExtractLinearSafeOutputsConfig(t *testing.T) {
 	assert.Equal(t, "${{ secrets.LINEAR_API_KEY }}", config.LinearToken)
 	require.NotNil(t, config.LinearCreateIssue)
 	assert.Equal(t, "9cfb482a-81e3-4154-b5b9-2c805e70a02d", config.LinearCreateIssue.TeamID)
+	assert.Equal(t, "810f57a7e383", config.LinearCreateIssue.ProjectID)
 	assert.Equal(t, "1", *config.LinearCreateIssue.Max)
 	require.NotNil(t, config.LinearAddComment)
 	assert.Equal(t, "ENG-123", config.LinearAddComment.Target)
@@ -48,6 +50,7 @@ func TestLinearHandlerConfigExcludesCredential(t *testing.T) {
 		LinearCreateIssue: &LinearCreateIssueConfig{
 			BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 			TeamID:               "9cfb482a-81e3-4154-b5b9-2c805e70a02d",
+			ProjectID:            "810f57a7e383",
 		},
 		LinearAddComment: &LinearTargetConfig{
 			BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("2")},
@@ -66,6 +69,7 @@ func TestLinearHandlerConfigExcludesCredential(t *testing.T) {
 
 	var parsed map[string]any
 	require.NoError(t, json.Unmarshal([]byte(result), &parsed))
+	assert.Equal(t, "810f57a7e383", parsed["linear_create_issue"].(map[string]any)["project_id"])
 	assert.Equal(t, "ENG-123", parsed["linear_add_comment"].(map[string]any)["target"])
 	assert.Equal(t, true, parsed["linear_update_issue"].(map[string]any)["allow_title"])
 }

pkg/workflow/safe_outputs_env.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/github/gh-aw/pkg/constants"
 	"github.com/github/gh-aw/pkg/logger"
+	"github.com/github/gh-aw/pkg/sliceutil"
 )
 
 var safeOutputsEnvLog = logger.New("workflow:safe_outputs_env")
@@ -216,8 +217,8 @@ func buildEngineMetadataEnvVars(engineConfig *EngineConfig, model string) []stri
 // addCustomSafeOutputEnvVars adds custom environment variables to safe output job steps
 func (c *Compiler) addCustomSafeOutputEnvVars(steps *[]string, data *WorkflowData) {
 	if data.SafeOutputs != nil && len(data.SafeOutputs.Env) > 0 {
-		for key, value := range data.SafeOutputs.Env {
-			*steps = append(*steps, fmt.Sprintf("          %s: %s\n", key, value))
+		for _, key := range sliceutil.SortedKeys(data.SafeOutputs.Env) {
+			*steps = append(*steps, fmt.Sprintf("          %s: %s\n", key, data.SafeOutputs.Env[key]))
 		}
 	}
 }

pkg/workflow/safe_outputs_handler_registry_linear.go

@@ -9,6 +9,7 @@ var linearHandlerRegistry = map[string]handlerBuilder{
 		return newHandlerConfigBuilder().
 			AddTemplatableInt("max", c.Max).
 			AddIfNotEmpty("team_id", c.TeamID).
+			AddIfNotEmpty("project_id", c.ProjectID).
 			AddTemplatableBool("staged", templatableBoolPtrToStringPtr(c.Staged)).
 			Build()
 	},

pkg/workflow/safe_outputs_test.go

@@ -11,6 +11,27 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+func TestAddCustomSafeOutputEnvVarsSortsKeys(t *testing.T) {
+	steps := []string{}
+	data := &WorkflowData{
+		SafeOutputs: &SafeOutputsConfig{
+			Env: map[string]string{
+				"Z_VAR": "last",
+				"A_VAR": "first",
+				"M_VAR": "middle",
+			},
+		},
+	}
+
+	(&Compiler{}).addCustomSafeOutputEnvVars(&steps, data)
+
+	require.Equal(t, []string{
+		"          A_VAR: first\n",
+		"          M_VAR: middle\n",
+		"          Z_VAR: last\n",
+	}, steps)
+}
+
 // ========================================
 // HasSafeOutputsEnabled Tests
 // ========================================