[plan] Add authenticated external API pattern (bash+curl+secrets) to create-agentic-workflow.md #19323

Objective

Add a standardized "authenticated external API" pattern to .github/aw/create-agentic-workflow.md so the agentic workflow creator reliably recommends bash+curl with secrets injection when workflows need to call external APIs that require authentication — since web-fetch is unauthenticated.

Context

From the Agent Persona Exploration (discussion #19306), scenario DV2 (Cloud Cost Anomaly Digest) scored 3/5 because web-fetch has no built-in auth header support. Multi-cloud billing APIs require OAuth/API keys. The agent suggested a bash+curl workaround but inconsistently. A standardized template in the prompt would prevent this friction for all API-integration workflows.

Approach

1. Open .github/aw/create-agentic-workflow.md
2. Locate the Web access / API integration guidance (around line 587)
3. Add a new sub-section: "When external APIs require authentication", with content like:

#### When external APIs require authentication

`web-fetch` does not support auth headers. For authenticated API calls, use `bash` + `curl` with secrets:

```yaml
# In frontmatter
network:
  allowed:
    - api.example.com

# In prompt — instruct the agent to use:
curl -s -H "Authorization: Bearer ${{ secrets.API_TOKEN }}" \
     (api.example.com/redacted)

Secret naming conventions:

• secrets.CLOUD_BILLING_TOKEN for cloud billing APIs
• secrets.SENTRY_TOKEN for error tracking
• secrets.PAGERDUTY_TOKEN for incident management

Always declare secrets in the workflow frontmatter under secrets: so they are available at runtime.

4. Update the tools selection heuristics table (around line 237) to note: `web-fetch` = unauthenticated; for authenticated APIs use `bash`+`curl`+secrets.

## Files to Modify

- `.github/aw/create-agentic-workflow.md` — add auth pattern section and update tool heuristics

## Acceptance Criteria

- [ ] A dedicated section explains the `web-fetch` auth limitation
- [ ] Template shows `bash`+`curl` pattern with `${{ secrets.X }}` injection
- [ ] Secret naming conventions are provided
- [ ] Tool selection heuristics note `web-fetch` is unauthenticated
- [ ] Lock file recompiled: `make recompile`




> Generated by [Plan Command](https://github.com/github/gh-aw/actions/runs/22607648937) for issue #discussion #19306
> - [x] expires <!-- gh-aw-expires: 2026-03-05T04:03:21.981Z --> on Mar 5, 2026, 4:03 AM UTC

<!-- gh-aw-agentic-workflow: Plan Command, engine: copilot, id: 22607648937, workflow_id: plan, run: https://github.com/github/gh-aw/actions/runs/22607648937 -->

<!-- gh-aw-workflow-id: plan -->
<!-- gh-aw-workflow-call-id: github/gh-aw/Plan Command -->