Fix GitHub token chaining for safe outputs #8159
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Create new getEffectiveSafeOutputGitHubToken function that uses simpler token chain: per-output > global > workflow > GITHUB_TOKEN (removing GH_AW_GITHUB_MCP_SERVER_TOKEN and GH_AW_GITHUB_TOKEN from the fallback). This ensures safe outputs follow the correct token precedence: safe outputs token -> workflow token -> GitHub Actions token Co-authored-by: pelikhan <[email protected]>
The integration test was trying to test workflow-level tokens, but WorkflowData.GitHubToken is only populated from tools.github config, not from top-level frontmatter. The unit tests for getEffectiveSafeOutputGitHubToken properly verify the correct behavior. Co-authored-by: pelikhan <[email protected]>
Copilot
AI
changed the title
[WIP] Review GitHub token chaining for safe output entries
Fix GitHub token chaining for safe outputs
Dec 30, 2025
Contributor
|
@copilot It should be secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN |
Change the fallback chain from just GITHUB_TOKEN to GH_AW_GITHUB_TOKEN || GITHUB_TOKEN as requested. The correct chain is now: per-output > global > workflow > GH_AW_GITHUB_TOKEN || GITHUB_TOKEN Co-authored-by: pelikhan <[email protected]>
Contributor
Author
Contributor
|
@copilot recompile |
Regenerated all workflow lock files to use the corrected safe outputs token chain: GH_AW_GITHUB_TOKEN || GITHUB_TOKEN Updated 118 workflow lock files. Co-authored-by: pelikhan <[email protected]>
Contributor
Author
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Safe outputs were incorrectly using the MCP server token fallback chain (
GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN) instead of the correct simplified chain.Changes
getEffectiveSafeOutputGitHubToken()- Returns simplified fallback chain ending withGH_AW_GITHUB_TOKEN || GITHUB_TOKENaddSafeOutputGitHubTokenForConfig()- Uses new function instead ofgetEffectiveGitHubToken()addCustomActionGitHubToken()- Uses new function for standard safe output operationsgetEffectiveGitHubToken()unchanged for MCP servers and GitHub toolsToken Precedence
Before:
After:
The MCP token chain remains appropriate for MCP servers and GitHub tools, but safe outputs should use a simpler chain that removes only the
GH_AW_GITHUB_MCP_SERVER_TOKENwhile keepingGH_AW_GITHUB_TOKENas a fallback beforeGITHUB_TOKEN.All workflow lock files have been recompiled to use the corrected token chain.
Original prompt
✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.