`allowed-events` should constrain the generated PR review tool schema

[jonathanpeppers]

Summary

Configuring submit-pull-request-review.allowed-events: [COMMENT] enforces the restriction only when Safe Outputs processes the agent result. The generated submit_pull_request_review tool schema still advertises APPROVE, REQUEST_CHANGES, and COMMENT.

An agent can therefore select a disallowed event. Runtime enforcement correctly rejects it, but the workflow is then flagged by threat detection and fails instead of simply posting its review.

Reproduction

Our workflow configures:

safe-outputs:
  create-pull-request-review-comment:
    max: 50
  submit-pull-request-review:
    max: 1
    allowed-events: [COMMENT]

The prompt also explicitly required a COMMENT review and prohibited APPROVE or REQUEST_CHANGES.

During this run, the agent emitted submit_pull_request_review with event: REQUEST_CHANGES:

• Run logs: https://github.com/dotnet/android/actions/runs/32401732757
• Resulting failure comment: [build] Disable CoreCLR ReadyToRun without trimming dotnet/android#12445 (comment)

Threat detection classified this as prompt injection because the output overrode the workflow instruction. Safe Outputs then rejected it with:

Review event 'REQUEST_CHANGES' is not allowed by safe-outputs configuration. Allowed events: COMMENT

The job ended in partial_success with one failed safe output. Buffered comments were eventually submitted through a body-only fallback, but the workflow was marked failed and the review carried an agentic-threat warning.

Expected behavior

When allowed-events is configured, the compiler should project that restriction into the generated tool schema and validation configuration. For allowed-events: [COMMENT], submit_pull_request_review.event.enum should contain only COMMENT (or the event field could be omitted and default to COMMENT).

This would prevent the model from selecting an event that runtime policy will inevitably reject while retaining runtime enforcement as defense in depth.

Relevant implementation

The event enum appears to remain static in:

• pkg/workflow/js/safe_outputs_tools.json
• pkg/workflow/safe_outputs_validation_config.go

allowed_events is passed to and enforced by actions/setup/js/submit_pr_review.cjs, but does not appear to narrow the generated tool definition.

Related: #25484 added the allowed-events runtime filter.