[aw] Decouple Process Safe Outputs client token from project-specific token

actions/setup/js/handler_auth.cjs

@@ -14,7 +14,7 @@
  *   2. global github          — step-level token set in the github-script with.github-token
  *
  * The step-level token itself follows (as set by the Go compiler):
- *   project token > global safe-outputs.github-token > magic secrets
+ *   global safe-outputs.github-token > magic secrets
  */
 
 /**

actions/setup/js/safe_output_handler_manager.cjs

@@ -29,6 +29,7 @@ const { checkRateLimitHeadroom } = require("./rate_limit_helpers.cjs");
 const { redactSensitiveConfig } = require("./safe_outputs_config_redact.cjs");
 const nodePath = require("path");
 const fs = require("fs");
+const GITHUB_TOKEN_CONFIG_KEY = "github-token";
 
 /**
  * Handler map configuration
@@ -101,6 +102,9 @@ const STANDALONE_STEP_TYPES = new Set(["upload_asset", "noop"]);
  */
 const CODE_PUSH_TYPES = new Set(["push_to_pull_request_branch", "create_pull_request"]);
 
+/** @type {Set<string>} Project-safe-output handlers that should default to GH_AW_PROJECT_GITHUB_TOKEN when no per-handler github-token is configured. */
+const PROJECT_HANDLER_TYPES = new Set(["create_project", "create_project_status_update", "update_project"]);
+
 // Threat-detection warn-mode requirement IDs from safe-outputs specification:
 // - WTD2: Convertible outputs must be mapped to a reviewable type.
 // - WTD3: Non-reviewable outputs must be aborted.
@@ -283,6 +287,37 @@ function loadConfig() {
 /** @type {Set<string>} Handler types that participate in the PR review buffer */
 const PR_REVIEW_HANDLER_TYPES = new Set(["create_pull_request_review_comment", "submit_pull_request_review"]);
 
+/**
+ * Wrap a handler so project-safe-output execution can temporarily bind global.github
+ * to the handler-specific authenticated client.
+ *
+ * @param {string} type - Safe-output handler type
+ * @param {Function} messageHandler - Loaded handler function
+ * @param {Object|null} handlerGithubClient - Optional per-handler GitHub client
+ * @returns {Function} Wrapped handler function
+ */
+function wrapWithClientRebinding(type, messageHandler, handlerGithubClient) {
+  if (!PROJECT_HANDLER_TYPES.has(type) || !handlerGithubClient) {
+    return messageHandler;
+  }
+  return async (...args) => {
+    /** @type {any} */
+    const globalState = global;
+    const hadGithub = Object.prototype.hasOwnProperty.call(globalState, "github");
+    const previousGithub = globalState.github;
+    globalState.github = handlerGithubClient;
+    try {
+      return await messageHandler(...args);
+    } finally {
+      if (hadGithub) {
+        globalState.github = previousGithub;
+      } else {
+        delete globalState.github;
+      }
+    }
+  };
+}
+
 /**
  * Load and initialize handlers for enabled safe output types
  * Calls each handler's factory function (main) to get message processors
@@ -306,6 +341,10 @@ async function loadHandlers(config, prReviewBufferRegistry, resolvedAllowedMenti
           // Call the factory function with config to get the message handler
           const handlerConfig = { ...(config[type] || {}) };
 
+          if (PROJECT_HANDLER_TYPES.has(type) && !handlerConfig[GITHUB_TOKEN_CONFIG_KEY] && process.env.GH_AW_PROJECT_GITHUB_TOKEN) {
+            handlerConfig[GITHUB_TOKEN_CONFIG_KEY] = process.env.GH_AW_PROJECT_GITHUB_TOKEN;
+          }
+
           // Pass top-level mentions policy through so handlers can preserve
           // the same allowed mention aliases used during collection.
           if (handlerConfig.mentions == null && config.mentions != null) {
@@ -320,7 +359,14 @@ async function loadHandlers(config, prReviewBufferRegistry, resolvedAllowedMenti
             handlerConfig._prReviewBufferRegistry = prReviewBufferRegistry;
           }
 
-          const messageHandler = await handlerModule.main(handlerConfig);
+          /** @type {any|null} */
+          let handlerGithubClient = null;
+          /** @type {any} */
+          const globalState = global;
+          if (handlerConfig[GITHUB_TOKEN_CONFIG_KEY] && typeof globalState.getOctokit === "function") {
+            handlerGithubClient = globalState.getOctokit(handlerConfig[GITHUB_TOKEN_CONFIG_KEY]);
+          }
+          const messageHandler = await handlerModule.main(handlerConfig, handlerGithubClient);
 
           if (typeof messageHandler !== "function") {
             // This is a fatal error - the handler is misconfigured
@@ -330,7 +376,7 @@ async function loadHandlers(config, prReviewBufferRegistry, resolvedAllowedMenti
             throw error;
           }
 
-          messageHandlers.set(type, messageHandler);
+          messageHandlers.set(type, wrapWithClientRebinding(type, messageHandler, handlerGithubClient));
           core.info(`✓ Loaded and initialized handler for: ${type}`);
         } else {
           core.warning(`Handler module ${type} does not export a main function`);

actions/setup/js/safe_output_handler_manager.test.cjs

@@ -277,20 +277,141 @@ describe("Safe Output Handler Manager", () => {
             max: 1,
             mentions: mentionsConfig,
             allowedMentionAliases: ["copilot", "octocat"],
-          })
+          }),
+          null
         );
         expect(createIssueMainSpy).toHaveBeenCalledWith(
           expect.objectContaining({
             max: 1,
             mentions: mentionsConfig,
             allowedMentionAliases: ["copilot", "octocat"],
-          })
+          }),
+          null
         );
       } finally {
         addCommentMainSpy.mockRestore();
         createIssueMainSpy.mockRestore();
       }
     });
+
+    it("injects GH_AW_PROJECT_GITHUB_TOKEN for project handlers when github-token is missing", async () => {
+      process.env.GH_AW_PROJECT_GITHUB_TOKEN = "projects-token";
+      global.getOctokit = vi.fn().mockReturnValue({ client: "project-client" });
+
+      const updateProjectModule = require("./update_project.cjs");
+      const updateProjectMainSpy = vi.spyOn(updateProjectModule, "main").mockImplementation(async () => async () => ({ success: true }));
+
+      try {
+        const handlers = await loadHandlers({
+          update_project: { project: "https://github.com/orgs/myorg/projects/1" },
+        });
+
+        expect(handlers.has("update_project")).toBe(true);
+        expect(global.getOctokit).toHaveBeenCalledWith("projects-token");
+        expect(updateProjectMainSpy).toHaveBeenCalledWith(
+          expect.objectContaining({
+            project: "https://github.com/orgs/myorg/projects/1",
+            "github-token": "projects-token",
+          }),
+          expect.objectContaining({ client: "project-client" })
+        );
+      } finally {
+        updateProjectMainSpy.mockRestore();
+        delete process.env.GH_AW_PROJECT_GITHUB_TOKEN;
+        delete global.getOctokit;
+      }
+    });
+
+    it("preserves explicit project handler github-token over GH_AW_PROJECT_GITHUB_TOKEN fallback", async () => {
+      process.env.GH_AW_PROJECT_GITHUB_TOKEN = "fallback-project-token";
+      global.getOctokit = vi.fn().mockReturnValue({ client: "project-client" });
+
+      const updateProjectModule = require("./update_project.cjs");
+      const updateProjectMainSpy = vi.spyOn(updateProjectModule, "main").mockImplementation(async () => async () => ({ success: true }));
+
+      try {
+        await loadHandlers({
+          update_project: {
+            project: "https://github.com/orgs/myorg/projects/1",
+            "github-token": "explicit-project-token",
+          },
+        });
+
+        expect(global.getOctokit).toHaveBeenCalledWith("explicit-project-token");
+        expect(updateProjectMainSpy).toHaveBeenCalledWith(
+          expect.objectContaining({
+            "github-token": "explicit-project-token",
+          }),
+          expect.objectContaining({ client: "project-client" })
+        );
+      } finally {
+        updateProjectMainSpy.mockRestore();
+        delete process.env.GH_AW_PROJECT_GITHUB_TOKEN;
+        delete global.getOctokit;
+      }
+    });
+
+    it("wraps project handlers so global.github is set to the project client during execution", async () => {
+      process.env.GH_AW_PROJECT_GITHUB_TOKEN = "projects-token";
+      const projectClient = { client: "project-client" };
+      global.getOctokit = vi.fn().mockReturnValue(projectClient);
+
+      const previousGithub = { client: "shared-client" };
+      global.github = previousGithub;
+      let seenGithub = null;
+
+      const updateProjectModule = require("./update_project.cjs");
+      const updateProjectMainSpy = vi.spyOn(updateProjectModule, "main").mockImplementation(async () => async () => {
+        // outer function: handler factory at loadHandlers() time; inner function: message handler at processMessages() time
+        seenGithub = global.github;
+        return { success: true };
+      });
+
+      try {
+        const handlers = await loadHandlers({
+          update_project: { project: "https://github.com/orgs/myorg/projects/1" },
+        });
+        const handler = handlers.get("update_project");
+        expect(typeof handler).toBe("function");
+
+        await handler({ type: "update_project" });
+
+        expect(seenGithub).toBe(projectClient);
+        expect(global.github).toBe(previousGithub);
+      } finally {
+        updateProjectMainSpy.mockRestore();
+        delete process.env.GH_AW_PROJECT_GITHUB_TOKEN;
+        delete global.getOctokit;
+        global.github = previousGithub;
+      }
+    });
+
+    it("restores global.github to absent state after wrapped project handler execution", async () => {
+      process.env.GH_AW_PROJECT_GITHUB_TOKEN = "projects-token";
+      const projectClient = { client: "project-client" };
+      global.getOctokit = vi.fn().mockReturnValue(projectClient);
+      delete global.github;
+
+      const updateProjectModule = require("./update_project.cjs");
+      const updateProjectMainSpy = vi.spyOn(updateProjectModule, "main").mockImplementation(async () => async () => ({ success: true }));
+
+      try {
+        const handlers = await loadHandlers({
+          update_project: { project: "https://github.com/orgs/myorg/projects/1" },
+        });
+        const handler = handlers.get("update_project");
+        expect(typeof handler).toBe("function");
+
+        await handler({ type: "update_project" });
+
+        expect("github" in global).toBe(false);
+      } finally {
+        updateProjectMainSpy.mockRestore();
+        delete process.env.GH_AW_PROJECT_GITHUB_TOKEN;
+        delete global.getOctokit;
+        delete global.github;
+      }
+    });
   });
 
   describe("loadHandlers - path traversal sanitization", () => {

pkg/workflow/compiler_safe_outputs_steps.go

@@ -272,24 +272,18 @@ func (c *Compiler) buildHandlerManagerStep(data *WorkflowData) ([]string, error)
 	}
 
 	// With section for github-token
-	// Use the standard safe outputs token for all operations.
-	// If project operations are configured, prefer the project token for the github-script client.
-	// Rationale: update_project/create_project_status_update call the Projects v2 GraphQL API, which
-	// cannot be accessed with the default GITHUB_TOKEN. GH_AW_PROJECT_GITHUB_TOKEN is the required
-	// token for Projects v2 operations.
+	// Use the standard safe-outputs token for the shared github-script client.
+	// Project operations use GH_AW_PROJECT_GITHUB_TOKEN from env with dedicated handler logic.
 	steps = append(steps, "        with:\n")
 	// Token precedence for the handler manager step:
-	//   1. Project token (if project operations are configured) - already set above
-	//   2. Safe-outputs level token (so.GitHubToken)
-	//   3. Magic secret fallback via getEffectiveSafeOutputGitHubToken()
+	//   1. Safe-outputs level token (so.GitHubToken)
+	//   2. Magic secret fallback via getEffectiveSafeOutputGitHubToken()
 	//
 	// Note: We do NOT fall back to per-output tokens (add-comment, create-issue, etc.)
 	// because those are specific to their operations. The handler manager needs a
 	// general-purpose token for the github-script client.
 	configToken := ""
-	if projectToken != "" {
-		configToken = projectToken
-	} else if data.SafeOutputs != nil && data.SafeOutputs.GitHubToken != "" {
+	if data.SafeOutputs != nil && data.SafeOutputs.GitHubToken != "" {
 		configToken = data.SafeOutputs.GitHubToken
 	}
 	c.addSafeOutputGitHubTokenForConfig(&steps, data, configToken)