From e3ed7e6eb0e20b92506bc966f271134c3c928bc4 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 5 May 2026 07:48:47 +0000
Subject: [PATCH 1/3] Initial plan


From 0c9b564c21c9d0c4335547c04288ec7d7322183b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 5 May 2026 07:58:00 +0000
Subject: [PATCH 2/3] fix: use ref.Name consistently in FirewallDriver.Update
 error formatting

Pass ref.Name (not spec.Name) to validateFirewallTargets so the
no-targets error always references the authoritative ref identity, even
when ref.Name and spec.Name diverge or spec.Name is empty.

Add regression test TestFirewallDriver_Update_NoTargets_RefNameInError
that explicitly sets a different ref.Name and spec.Name to assert the
error uses ref.Name.

Agent-Logs-Url: https://github.com/GoCodeAlone/workflow-plugin-digitalocean/sessions/8294bc4d-8194-4369-b026-d9e51cc8d951

Co-authored-by: intel352 <77607+intel352@users.noreply.github.com>
---
 internal/drivers/firewall.go      |  2 +-
 internal/drivers/firewall_test.go | 25 +++++++++++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/internal/drivers/firewall.go b/internal/drivers/firewall.go
index 8cadb91..ddd1235 100644
--- a/internal/drivers/firewall.go
+++ b/internal/drivers/firewall.go
@@ -125,7 +125,7 @@ func (d *FirewallDriver) Update(ctx context.Context, ref interfaces.ResourceRef,
 	if err != nil {
 		return nil, fmt.Errorf("firewall update %q: %w", ref.Name, err)
 	}
-	if err := validateFirewallTargets(spec.Name, req); err != nil {
+	if err := validateFirewallTargets(ref.Name, req); err != nil {
 		return nil, err
 	}
 	providerID, err := d.resolveProviderID(ctx, ref)
diff --git a/internal/drivers/firewall_test.go b/internal/drivers/firewall_test.go
index cbdc5d2..719705b 100644
--- a/internal/drivers/firewall_test.go
+++ b/internal/drivers/firewall_test.go
@@ -498,6 +498,31 @@ func TestFirewallDriver_Update_NoTargets_Errors(t *testing.T) {
 	}
 }
 
+// TestFirewallDriver_Update_NoTargets_RefNameInError is a regression test for
+// the case where ref.Name and spec.Name diverge. The no-targets error must
+// reference ref.Name (the authoritative identity), not spec.Name.
+func TestFirewallDriver_Update_NoTargets_RefNameInError(t *testing.T) {
+	mock := &mockFirewallClient{fw: testFirewall()}
+	d := drivers.NewFirewallDriverWithClient(mock)
+
+	_, err := d.Update(context.Background(), interfaces.ResourceRef{
+		Name: "ref-name", ProviderID: "f8b6200c-3bba-48a7-8bf1-7a3e3a885eb5",
+	}, interfaces.ResourceSpec{
+		Name:   "spec-name", // intentionally different from ref.Name
+		Config: map[string]any{},
+	})
+	if err == nil {
+		t.Fatal("expected error for empty targets, got nil")
+	}
+	want := fmt.Sprintf(drivers.NoTargetsErrFmt, "ref-name")
+	if got := err.Error(); got != want {
+		t.Errorf("error uses wrong name:\n got: %q\nwant: %q", got, want)
+	}
+	if mock.lastReq != nil {
+		t.Error("FirewallRequest reached godo client despite empty-targets validation")
+	}
+}
+
 // TestFirewallDriver_Create_DropletIDs_AcceptsMixedNumeric verifies the
 // helper accepts the YAML-decoded numeric variants (int, int64, float64) the
 // modular YAML loader can produce.

From 88a6b349cf259f8e7281b4ecfe8ace6e86bc6161 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 5 May 2026 13:48:45 +0000
Subject: [PATCH 3/3] fix: use RELEASES_TOKEN for codemod-report PR comment
 step

Agent-Logs-Url: https://github.com/GoCodeAlone/workflow-plugin-digitalocean/sessions/64500282-714c-45fe-ac51-3080b615ac0a

Co-authored-by: intel352 <77607+intel352@users.noreply.github.com>
---
 .github/workflows/codemod-report.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/codemod-report.yml b/.github/workflows/codemod-report.yml
index 96a44c8..e84928c 100644
--- a/.github/workflows/codemod-report.yml
+++ b/.github/workflows/codemod-report.yml
@@ -55,6 +55,7 @@ jobs:
         if: github.event.pull_request.head.repo.fork == false
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea  # v7.0.1
         with:
+          github-token: ${{ secrets.RELEASES_TOKEN }}
           script: |
             const fs = require('fs');
             const summary = fs.readFileSync('/tmp/codemod-summary.md', 'utf8');