Add deterministic body footer templates to safe outputs

actions/setup/js/create_issue.cjs

@@ -4,7 +4,7 @@
 const { sanitizeLabelContent } = require("./sanitize_label_content.cjs");
 const { sanitizeTitle, applyTitlePrefix } = require("./sanitize_title.cjs");
 const { sanitizeContent } = require("./sanitize_content.cjs");
-const { generateFooterWithMessages, getDetectionCautionAlert } = require("./messages_footer.cjs");
+const { generateFooterWithMessages, getBodyFooterMessage, getDetectionCautionAlert } = require("./messages_footer.cjs");
 const { getBodyHeader, getDisclosureHeader } = require("./messages_header.cjs");
 const { generateWorkflowIdMarker, generateWorkflowCallIdMarker, generateCloseKeyMarker, normalizeCloseOlderKey } = require("./generate_footer.cjs");
 const { generateHistoryUrl } = require("./generate_history_link.cjs");
@@ -30,6 +30,7 @@ const { MAX_LABELS, MAX_ASSIGNEES } = require("./constants.cjs");
 const { findAgent, getIssueDetails, assignAgentToIssue } = require("./assign_agent_helpers.cjs");
 const { parseDeduplicateByTitle, normalizeTitleForDedup, findDuplicateByTitle } = require("./issue_title_dedup.cjs");
 const { resolveAllowedMentionsFromPayload } = require("./resolve_mentions_from_payload.cjs");
+const MAX_GITHUB_BODY_LENGTH = 65536;
 const MS_PER_DAY = 24 * 60 * 60 * 1000;
 const ISSUE_FIELD_DATE_PATTERN = /^\d{4}-\d{2}-\d{2}$/;
 const RECENTLY_CLOSED_DEDUP_DAYS = 30;
@@ -1079,6 +1080,11 @@ async function main(config = {}) {
       bodyLines.push(``, footer);
     }
 
+    const bodyFooter = getBodyFooterMessage(config.body_footer, { workflowName, runUrl });
+    if (bodyFooter) {
+      bodyLines.push(``, bodyFooter.trimEnd());
+    }
+
     // Add standalone workflow-id marker for searchability (consistent with comments)
     // Always add XML markers even when footer is disabled
     if (workflowId) {
@@ -1188,6 +1194,9 @@ async function main(config = {}) {
     }
 
     try {
+      if (body.length > MAX_GITHUB_BODY_LENGTH) {
+        throw new Error(`${ERR_VALIDATION}: Issue body exceeds GitHub's maximum length of ${MAX_GITHUB_BODY_LENGTH} characters`);
+      }
       const { data: issue } = await withRetry(
         () =>
           githubClient.rest.issues.create({

actions/setup/js/create_issue.test.cjs

@@ -126,6 +126,36 @@ describe("create_issue", () => {
       );
     });
 
+    it("should append the configured body footer when the generated footer is disabled", async () => {
+      const handler = await main({
+        footer: false,
+        body_footer: "Required footer from {workflow_name}: {run_url}",
+      });
+      await handler({
+        title: "Test Issue",
+        body: "Test body content",
+      });
+
+      const createCall = mockGithub.rest.issues.create.mock.calls[0][0];
+      expect(createCall.body).toContain("Test body content\n\nRequired footer from Test Workflow: https://github.com/test-owner/test-repo/actions/runs/12345");
+      expect(createCall.body).not.toContain("> Generated by");
+      expect(createCall.body.indexOf("Required footer from Test Workflow")).toBeLessThan(createCall.body.indexOf("<!-- gh-aw-workflow-id:"));
+    });
+
+    it("should place the configured body footer after the generated footer", async () => {
+      const handler = await main({
+        body_footer: "Required final content",
+      });
+      await handler({
+        title: "Test Issue",
+        body: "Test body content",
+      });
+
+      const body = mockGithub.rest.issues.create.mock.calls[0][0].body;
+      expect(body.indexOf("> Generated by")).toBeLessThan(body.indexOf("Required final content"));
+      expect(body.indexOf("Required final content")).toBeLessThan(body.indexOf("<!-- gh-aw-workflow-id:"));
+    });
+
     it("should use body as title when title is missing", async () => {
       const handler = await main({});
       const result = await handler({

actions/setup/js/create_pull_request.cjs

@@ -19,6 +19,7 @@ const { generateWorkflowIdMarker, generateWorkflowCallIdMarker, generateCloseKey
 const { parseBoolTemplatable, parseIntTemplatable } = require("./templatable.cjs");
 const { assembleMarkdownBodyParts } = require("./markdown_body_helpers.cjs");
 const { getBodyHeader, getDisclosureHeader } = require("./messages_header.cjs");
+const { getBodyFooterMessage } = require("./messages_footer.cjs");
 const { generateHistoryUrl } = require("./generate_history_link.cjs");
 const { normalizeBranchName } = require("./normalize_branch_name.cjs");
 const { pushExtraEmptyCommit } = require("./extra_empty_commit.cjs");
@@ -64,6 +65,8 @@ const {
 } = require("./create_pull_request_helpers.cjs");
 const { isStackedEnabled, parseStackMetadata, hasCircularStackDependency, buildStackMetadataLines, stackedDisabledError, circularStackError, verifyStackBaseBranchExists, createStackTracker } = require("./stacked_pull_requests.cjs");
 
+const MAX_GITHUB_BODY_LENGTH = 65536;
+
 /**
  * @typedef {import('./types/handler-factory').HandlerFactoryFunction} HandlerFactoryFunction
  */
@@ -449,6 +452,10 @@ async function rewriteBundleBranchAsSingleCommit(baseBranch, execApi, bundleFile
  * @returns {Promise<{data: any, issueRepoParts: {owner: string, repo: string}}>}
  */
 async function createFallbackIssue(githubClient, repoParts, title, body, labels, assignees) {
+  if (body.length > MAX_GITHUB_BODY_LENGTH) {
+    throw new Error(`Fallback issue body exceeds GitHub's maximum length of ${MAX_GITHUB_BODY_LENGTH} characters`);
+  }
+
   const payload = {
     owner: repoParts.owner,
     repo: repoParts.repo,
@@ -1673,6 +1680,13 @@ async function main(config = {}) {
         footerParts.push(footer);
       }
 
+      const bodyFooter = getBodyFooterMessage(config.body_footer, { workflowName, runUrl });
+      if (bodyFooter) {
+        const renderedBodyFooter = bodyFooter.trimEnd();
+        bodyLines.push(``, renderedBodyFooter);
+        footerParts.push(renderedBodyFooter);
+      }
+
       // Add standalone workflow-id marker for searchability (consistent with comments)
       // Always add XML markers even when footer is disabled
       if (workflowId) {
@@ -1701,6 +1715,9 @@ async function main(config = {}) {
       const issueSafeBody = neutralizeClosingKeywordsForIssueBody(body);
       // Footer section (footer + workflow-id marker) used when ordering protected-files notices
       const footerContent = footerParts.join("\n\n");
+      const issueSafeFooterContent = neutralizeClosingKeywordsForIssueBody(footerContent);
+      const hiddenFallbackMetadata = [callerWorkflowId && generateWorkflowCallIdMarker(callerWorkflowId), closeOlderKey && generateCloseKeyMarker(closeOlderKey)].filter(Boolean).join("\n");
+      const issueSafeFallbackFooter = [issueSafeFooterContent, hiddenFallbackMetadata].filter(Boolean).join("\n");
 
       // Build labels array - merge config labels with message labels
       let labels = [...envLabels];
@@ -1903,7 +1920,7 @@ async function main(config = {}) {
                   .replace(/\s+/g, " ")
                   .trim();
                 const pushErrorSection = buildPushErrorSection(getErrorMessage(pushError), pushFailureMessage);
-                const fallbackBody = `${issueSafeBody}
+                const fallbackBody = `${issueSafeMainBodyContent}
 
 ---
 
@@ -1929,7 +1946,9 @@ git push ${shellQuote(pushRemoteUrl || "origin")} ${shellQuote(branchName)}
 gh pr create --title ${shellQuote(title)} --base ${shellQuote(baseBranch)} --head ${shellQuote(getPullRequestHeadRef(branchName))} --repo ${shellQuote(`${repoParts.owner}/${repoParts.repo}`)}
 \`\`\`
 
-</details>`;
+</details>
+
+${issueSafeFallbackFooter}`;
 
                 try {
                   const { data: issue, issueRepoParts } = await createFallbackIssue(githubClient, repoParts, title, fallbackBody, mergeFallbackIssueLabels(effectiveFallbackLabels), configAssignees);
@@ -2272,7 +2291,7 @@ gh pr create --title ${shellQuote(title)} --base ${shellQuote(baseBranch)} --hea
                   .replace(/\s+/g, " ")
                   .trim();
                 const pushErrorSection = buildPushErrorSection(getErrorMessage(pushError), pushFailureMessage);
-                const fallbackBody = `${issueSafeBody}
+                const fallbackBody = `${issueSafeMainBodyContent}
 
 ---
 
@@ -2299,7 +2318,9 @@ gh pr create --title ${shellQuote(title)} --base ${shellQuote(baseBranch)} --hea
 \`\`\`
 
 </details>
-${patchPreview}`;
+${patchPreview}
+
+${issueSafeFallbackFooter}`;
 
                 try {
                   const { data: issue, issueRepoParts } = await createFallbackIssue(githubClient, repoParts, title, fallbackBody, mergeFallbackIssueLabels(effectiveFallbackLabels), configAssignees);
@@ -2462,7 +2483,7 @@ ${patchPreview}`;
           const pushFailedTemplatePath = getPromptPath("manifest_protection_push_failed_fallback.md");
           fallbackBody = renderTemplateFromFile(pushFailedTemplatePath, {
             main_body: issueSafeMainBodyContent,
-            footer: footerContent,
+            footer: issueSafeFooterContent,
             files: fileList,
             apply_instructions: applyInstructions,
             branch_name: branchName,
@@ -2473,7 +2494,7 @@ ${patchPreview}`;
         } else {
           // Normal case — push succeeded, provide compare URL.
           const createPrUrl = buildManifestProtectionCreatePrUrl(githubServer, repoParts, baseBranch, branchName, title, undefined, getPullRequestHeadRef(branchName));
-          fallbackBody = renderManifestProtectionFallbackBody(issueSafeMainBodyContent, footerContent, fileList, createPrUrl);
+          fallbackBody = renderManifestProtectionFallbackBody(issueSafeMainBodyContent, issueSafeFooterContent, fileList, createPrUrl);
         }
 
         try {
@@ -2484,7 +2505,7 @@ ${patchPreview}`;
           if (!manifestProtectionPushFailedError) {
             try {
               const createPrUrl = buildManifestProtectionCreatePrUrl(githubServer, repoParts, baseBranch, branchName, title, issue.number, getPullRequestHeadRef(branchName));
-              const fallbackBodyWithCloseKeyword = renderManifestProtectionFallbackBody(issueSafeMainBodyContent, footerContent, fileList, createPrUrl);
+              const fallbackBodyWithCloseKeyword = renderManifestProtectionFallbackBody(issueSafeMainBodyContent, issueSafeFooterContent, fileList, createPrUrl);
 
               await withRetry(
                 () =>
@@ -2524,6 +2545,9 @@ ${patchPreview}`;
 
       // Try to create the pull request, with fallback to issue creation
       try {
+        if (body.length > MAX_GITHUB_BODY_LENGTH) {
+          throw new Error(`Pull request body exceeds GitHub's maximum length of ${MAX_GITHUB_BODY_LENGTH} characters`);
+        }
         const { data: pullRequest } = await createOrUpdatePullRequest({
           githubClient,
           repoParts,
@@ -2795,7 +2819,8 @@ ${patchPreview}`;
 
           const fallbackTemplatePath = getPromptPath("pr_permission_denied_fallback.md");
           const fallbackBody = renderTemplateFromFile(fallbackTemplatePath, {
-            body: issueSafeBody,
+            body: issueSafeMainBodyContent,
+            footer: issueSafeFallbackFooter,
             branch_name: branchName,
             create_pr_url: createPrUrl,
             faq_url: FAQ_CREATE_PR_PERMISSIONS_URL,
@@ -2858,7 +2883,7 @@ ${patchPreview}`;
           patchPreview = generatePatchPreview(patchContent);
         }
 
-        const fallbackBody = `${issueSafeBody}
+        const fallbackBody = `${issueSafeMainBodyContent}
 
 ---
 
@@ -2872,7 +2897,9 @@ To create the pull request manually:
 \`\`\`sh
 gh pr create --title "${title}" --base ${baseBranch} --head ${getPullRequestHeadRef(branchName)} --repo ${repoParts.owner}/${repoParts.repo}
 \`\`\`
-${patchPreview}`;
+${patchPreview}
+
+${issueSafeFallbackFooter}`;
 
         try {
           const { data: issue, issueRepoParts } = await createFallbackIssue(githubClient, repoParts, title, fallbackBody, mergeFallbackIssueLabels(effectiveFallbackLabels), configAssignees);

actions/setup/js/create_pull_request.test.cjs

@@ -1470,6 +1470,22 @@ describe("create_pull_request - auto-close-issue configuration", () => {
     expect(createCall?.body).not.toContain("Closes #");
     expect(createCall?.body).not.toContain("Resolves #");
   });
+
+  it("should append the configured body footer when the generated footer is disabled", async () => {
+    const { main } = require("./create_pull_request.cjs");
+    const handler = await main({
+      allow_empty: true,
+      footer: false,
+      body_footer: "Required pull request footer",
+    });
+
+    await handler({ title: "Test PR", body: "Test body" }, {});
+
+    const createCall = global.github.rest.pulls.create.mock.calls[0]?.[0];
+    expect(createCall?.body).toContain("Test body\n\n- Fixes #42\n\nRequired pull request footer");
+    expect(createCall?.body).not.toContain("> Generated by");
+    expect(createCall?.body.indexOf("Required pull request footer")).toBeLessThan(createCall?.body.indexOf("<!-- gh-aw-workflow-id:"));
+  });
 });
 
 describe("create_pull_request - max limit enforcement", () => {

actions/setup/js/messages.cjs

@@ -24,7 +24,16 @@
 const { getMessages, renderTemplate, renderTemplateFromFile } = require("./messages_core.cjs");
 
 // Re-export footer messages
-const { getDetectionCautionAlert, getFooterMessage, getFooterInstallMessage, getFooterAgentFailureIssueMessage, getFooterAgentFailureCommentMessage, generateFooterWithMessages, generateXMLMarker } = require("./messages_footer.cjs");
+const {
+  getDetectionCautionAlert,
+  getBodyFooterMessage,
+  getFooterMessage,
+  getFooterInstallMessage,
+  getFooterAgentFailureIssueMessage,
+  getFooterAgentFailureCommentMessage,
+  generateFooterWithMessages,
+  generateXMLMarker,
+} = require("./messages_footer.cjs");
 
 // Re-export staged mode messages
 const { getStagedTitle, getStagedDescription } = require("./messages_staged.cjs");
@@ -43,6 +52,7 @@ module.exports = {
   renderTemplate,
   renderTemplateFromFile,
   getDetectionCautionAlert,
+  getBodyFooterMessage,
   getFooterMessage,
   getFooterInstallMessage,
   getFooterAgentFailureIssueMessage,

actions/setup/js/messages.test.cjs

@@ -211,6 +211,17 @@ describe("messages.cjs", () => {
       expect(result).toBe("> Custom: [Custom Workflow](https://example.com/run/456)");
     });
 
+    it("should render a handler body footer template", async () => {
+      const { getBodyFooterMessage } = await import("./messages.cjs");
+
+      const result = getBodyFooterMessage("Generated by [{workflow_name}]({run_url})", {
+        workflowName: "Custom Workflow",
+        runUrl: "https://example.com/run/456",
+      });
+
+      expect(result).toBe("Generated by [Custom Workflow](https://example.com/run/456)");
+    });
+
     it("should NOT append triggering number suffix when custom footer is configured", async () => {
       process.env.GH_AW_SAFE_OUTPUT_MESSAGES = JSON.stringify({
         footer: "> Custom: [{workflow_name}]({run_url})",

actions/setup/js/messages_footer.cjs

@@ -293,6 +293,19 @@ function getFooterMessage(ctx) {
   return renderedDefaultFooter + getRunAgainHints(renderedDefaultFooter);
 }
 
+/**
+ * Render a deterministic footer configured for a generated issue or pull request body.
+ * @param {string|undefined} template - Body footer template
+ * @param {{workflowName: string, runUrl: string}} ctx - Template context
+ * @returns {string} Rendered body footer, or an empty string when not configured
+ */
+function getBodyFooterMessage(template, ctx) {
+  if (!template) {
+    return "";
+  }
+  return renderTemplate(template, toSnakeCase(ctx));
+}
+
 /**
  * @param {string|undefined} commandsJSON
  * @returns {string|undefined}
@@ -772,6 +785,7 @@ function generateFooterWithMessages(workflowName, runUrl, workflowSource, workfl
 
 module.exports = {
   getDetectionCautionAlert,
+  getBodyFooterMessage,
   getFooterMessage,
   getFooterInstallMessage,
   getFooterWorkflowRecompileMessage,

actions/setup/js/types/safe-outputs-config.d.ts

@@ -13,6 +13,7 @@ interface SafeOutputConfig {
  */
 interface CreateIssueConfig extends SafeOutputConfig {
   "title-prefix"?: string;
+  "body-footer"?: string;
   "deduplicate-by-title"?: boolean | number;
   labels?: string[];
   "target-repo"?: string;
@@ -94,6 +95,7 @@ interface AddCommentConfig extends SafeOutputConfig {
  */
 interface CreatePullRequestConfig extends SafeOutputConfig {
   "title-prefix"?: string;
+  "body-footer"?: string;
   labels?: string[];
   reviewers?: string | string[];
   "team-reviewers"?: string | string[];

actions/setup/md/pr_permission_denied_fallback.md

@@ -9,3 +9,5 @@
 > **[Click here to create the pull request]({create_pr_url})**
 
 To fix the permissions issue, go to **Settings** → **Actions** → **General** and enable **Allow GitHub Actions to create and approve pull requests**. See also: [gh-aw FAQ]({faq_url}){patch_preview}
+
+{footer}

docs/src/content/docs/reference/footers.md

@@ -54,6 +54,24 @@ safe-outputs:
 
 Individual handler settings always take precedence over the global setting.
 
+## Deterministic Body Footers
+
+Use `body-footer` on `create-issue` or `create-pull-request` to append workflow-defined content after the agent-generated body:
+
+```yaml wrap
+safe-outputs:
+  create-issue:
+    body-footer: |
+      ---
+      Generated by [{workflow_name}]({run_url})
+  create-pull-request:
+    body-footer: |
+      ---
+      Review the generated changes before merging.
+```
+
+The body footer is appended even when `footer: false`. It is the final visible content in the body; hidden workflow metadata remains after it. The template supports `{workflow_name}` and `{run_url}` placeholders.
+
 ## PR Review Footer Control
 
 For PR reviews (`submit-pull-request-review`), the `footer` field supports conditional control over when the footer is added to the review body: