This was generated by AI during triage.
Summary
gh-aw v0.82.14 generates safe-output checkout steps with:
token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}If a repository has an older GH_AW_GITHUB_TOKEN secret, it shadows the
automatic repository token for every trusted safe-output checkout. A stale,
expired, SSO-unapproved, or differently scoped secret then prevents checkout of
both the private control-plane repository and a public target repository.
Version
gh aw version v0.82.14
Reproduction
Use a private control-plane repository that has GH_AW_GITHUB_TOKEN configured
and targets a different public repository:
checkout:
- sparse-checkout: |
.github/workflows/example.md
- repository: owner/public-target
path: ./target
current: true
safe-outputs:
github-app:
client-id: ${{ steps.app.outputs.client-id }}
private-key: ${{ steps.app.outputs.private-key }}
owner: owner
repositories: [public-target]
create-pull-request:
target-repo: owner/public-targetActual result
The generated safe-output checkout uses GH_AW_GITHUB_TOKEN ahead of the
automatic token. In our repository that secret was last updated months earlier;
both mirrored checkouts fail:
fatal: could not read Username for 'https://github.com': terminal prompts disabled
Concrete run:
https://github.com/microsoft/vscode-engineering/actions/runs/29877683511
The activation, agent, and threat-detection paths completed far enough to
produce and approve a patch. Safe outputs could not apply it.
Expected result
The trusted safe-output checkout of the workflow repository should use
${{ github.token }} by default. Authentication used for target-repository
writes should remain separately configurable through
safe-outputs.github-app/per-output tokens.
At minimum, the generated workflow should make the selected checkout credential
explicit enough to diagnose and override without replacing the write credential
or manually editing the lock file.
This also appears inconsistent with the checkout documentation, which states
that the safe-output job uses GITHUB_TOKEN for checkout and the
safe-outputs.github-app governs PR/push operations rather than control-plane
checkout.
Security relevance
The current precedence encourages a single long-lived token to cover both the
private control plane and public write targets. Separating checkout and output
credentials avoids broadening either token.
Summary
gh-aw v0.82.14 generates safe-output checkout steps with:
If a repository has an older
GH_AW_GITHUB_TOKENsecret, it shadows theautomatic repository token for every trusted safe-output checkout. A stale,
expired, SSO-unapproved, or differently scoped secret then prevents checkout of
both the private control-plane repository and a public target repository.
Version
gh aw version v0.82.14Reproduction
Use a private control-plane repository that has
GH_AW_GITHUB_TOKENconfiguredand targets a different public repository:
Actual result
The generated safe-output checkout uses
GH_AW_GITHUB_TOKENahead of theautomatic token. In our repository that secret was last updated months earlier;
both mirrored checkouts fail:
Concrete run:
https://github.com/microsoft/vscode-engineering/actions/runs/29877683511
The activation, agent, and threat-detection paths completed far enough to
produce and approve a patch. Safe outputs could not apply it.
Expected result
The trusted safe-output checkout of the workflow repository should use
${{ github.token }}by default. Authentication used for target-repositorywrites should remain separately configurable through
safe-outputs.github-app/per-output tokens.At minimum, the generated workflow should make the selected checkout credential
explicit enough to diagnose and override without replacing the write credential
or manually editing the lock file.
This also appears inconsistent with the checkout documentation, which states
that the safe-output job uses
GITHUB_TOKENfor checkout and thesafe-outputs.github-appgoverns PR/push operations rather than control-planecheckout.
Security relevance
The current precedence encourages a single long-lived token to cover both the
private control plane and public write targets. Separating checkout and output
credentials avoids broadening either token.