[dependabot:release-train-updater] create_pull_request fails with "no commits found" for self-target githubnext/gh-aw-cao

## Summary

Prepared, validated fix for `create_pull_request` — this is the **3rd confirmed occurrence** of `create_pull_request` failing with `"No changes to commit - no commits found"` for `githubnext/gh-aw-cao` specifically, when the workspace root IS the target repo (self-target scenario). Two DIFFERENT prior diffs (undici override fix, astro patch bump) hit the identical error; this run makes a third, with a third unrelated diff. Root cause is very likely a bug in the `create_pull_request` safe-output tool for this self-target case (workspace root == target repo), not a diff-size/content issue.

### This run's prepared fix (not applied — blocked by the tool bug)

**Candidate**: Align GitHub Actions pins to repo-wide latest versions.

- `.github/workflows/enterprise-canary.yml`, `enterprise-stress.yml`, `release.yml`, `review-smoke.yml`, `workflow-contracts.yml` were still pinned to `actions/checkout@v6`, `actions/setup-node@v4`, `actions/github-script@v8`, while every other workflow in the repo already uses `actions/checkout@v7.0.1`, `actions/setup-node@v7.0.0`, `actions/github-script@v9.0.0`.
- Bumped these 5 files to match the SHA/version pins already proven working elsewhere in the repo. No `.md` source exists for these files (hand-authored plain workflow YAML), so no `gh aw compile` regeneration was needed.
- `actions/github-script@v9` breaking change (`require('@actions/github')` removed, `getOctokit` now injected) checked against `release.yml`'s inline script — not used, safe to bump.
- Validation: YAML syntax valid for all 5 files (`python3 -c "import yaml; yaml.safe_load(...)"`), `git diff --stat` confirms exactly 5 intended files changed, no unrelated churn.
- Branch: `dependabot-agent/gh-actions-version-alignment-20260911010244`, commit `78bdf6d6` on top of `main@70547a8d`.
- Verified BEFORE both `create_pull_request` attempts: `git log origin/main..HEAD --oneline` showed exactly 1 commit; `git diff origin/main HEAD --stat` showed exactly the 5 expected files.

### Tool failures (2 attempts, per retry-limit policy)

1. Attempt 1 (title/branch/body only): `{"result":"error","error":"No changes to commit - no commits found",...}`
2. Attempt 2 (added explicit `base: "main"`): identical error.

Manual-apply patch (diff, 111 lines)

```diff
diff --git a/.github/workflows/enterprise-canary.yml b/.github/workflows/enterprise-canary.yml
index ddb63e5c..61076548 100644
--- a/.github/workflows/enterprise-canary.yml
+++ b/.github/workflows/enterprise-canary.yml
@@ -45,7 +45,7 @@ jobs:
timeout-minutes: 120
environment: central-agentic-ops-${{ inputs.safe_output_mode }}
steps:
- - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Run enterprise canary
env:
BUNDLE: ${{ inputs.bundle }}
diff --git a/.github/workflows/enterprise-stress.yml b/.github/workflows/enterprise-stress.yml
index 280aa752..b73390f2 100644
--- a/.github/workflows/enterprise-stress.yml
+++ b/.github/workflows/enterprise-stress.yml
@@ -41,7 +41,7 @@ jobs:
timeout-minutes: 120
environment: central-agentic-ops-${{ 'stress' }}
steps:
- - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Run bounded review stress canary
env:
BUNDLE: ${{ inputs.bundle }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d263f240..83d290a6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,7 +26,7 @@ jobs:
steps:
- name: Authorize request and compute version
id: version
- uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
RELEASE_BUMP: ${{ inputs.bump }}
TRIGGERING_ACTOR: ${{ github.triggering_actor }}
@@ -119,8 +119,8 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
- - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: 24
- name: Install gh-aw
@@ -143,7 +143,7 @@ jobs:
contents: write
steps:
- name: Generate draft release notes without assets
- uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
RELEASE_TAG: ${{ needs.resolve-version.outputs.release_tag }}
with:
diff --git a/.github/workflows/review-smoke.yml b/.github/workflows/review-smoke.yml
index f40de00c..ef1a6360 100644
--- a/.github/workflows/review-smoke.yml
+++ b/.github/workflows/review-smoke.yml
@@ -38,7 +38,7 @@ jobs:
timeout-minutes: 75
environment: central-agentic-ops-review
steps:
- - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Dispatch, monitor, and verify review canary
env:
BUNDLE: ${{ inputs.bundle }}
diff --git a/.github/workflows/workflow-contracts.yml b/.github/workflows/workflow-contracts.yml
index 76abf839..24062f0c 100644
--- a/.github/workflows/workflow-contracts.yml
+++ b/.github/workflows/workflow-contracts.yml
@@ -20,8 +20,8 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
- - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: 24
cache: npm
@@ -43,10 +43,10 @@ jobs:
has-changes: ${{ steps.matrix.outputs.has-changes }}
matrix: ${{ steps.matrix.outputs.matrix }}
steps:
- - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0
- - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+ - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: 24
cache: npm
@@ -80,8 +80,8 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
- - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: 24
- name: Check package API capacity
```

## Prior occurrences of this same bug (for pattern confirmation)

- `2026-09-10-07-55-35` cache entry: undici override fix, diff 41+/34- lines — same error.
- `2026-09-10-14-37-21` cache entry: astro + `@astrojs/markdown-remark` patch bump, diff 50+/11- lines — same error, escalated to `create_issue` that run too.
- This run: GitHub Actions pin alignment, diff 13+/13- lines — same error again.

Three different diffs, three different branch names, three different commit SHAs, identical error every time. This strongly suggests a bug in `create_pull_request` specific to the case where `target_repo == githubnext/gh-aw-cao` and the workspace root is used directly (not a separate `target/` checkout).

## Recommended next step

Investigate the `create_pull_request` safe-output tool implementation for the self-target case (workspace root == target repo, as opposed to a separate `target/` checkout). If this recurs a 4th time, treat it as confirmed systemic and consider routing self-target PRs through the `target/`-checkout code path instead, or documenting a required workaround.

## Control Plane
- Correlation ID: 34548424529-195
- Central repo: githubnext/gh-aw-cao
- Run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34548424529

> Generated by [:dependabot: Dependabot / Release Trains](https://github.com/githubnext/gh-aw-cao/actions/runs/34548689366) · copilot · auto · 96.3 AIC · ⌖ 13.5 AIC · ⊞ 18.1K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fdependabot-release-train-updater%22&type=issues)
>

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

```
gh aw add githubnext/gh-aw-cao/.github/workflows/dependabot-release-train-updater.md@main
```

> - [x] expires on Sep 25, 2026, 1:08 AM UTC

Start at the create_pull_request safe-output tool implementation and trace how it handles a workspace root that is also the target repository. Compare that path with the separate target/ checkout path, using the three reported self-target failures and the prepared workflow changes as reproduction context. Done means a self-target invocation recognizes the existing commit and creates the pull request instead of reporting no commits found.

Written by the indexing model from the issue text.