`safe_outputs` default checkout of workflow repo uses `safe-outputs.github-app` token, breaking cross-org workflows

[holwerda]

safe_outputs default checkout of workflow repo uses safe-outputs.github-app token, breaking cross-org workflows

Summary

When safe-outputs.github-app is configured with owner: pointing to a different org than the workflow repo, the compiler-generated "Checkout repository" step in safe_outputs uses the safe-outputs.github-app token to check out the workflow repo. Since that token is scoped to the target org, the checkout fails with an authentication error.

The agent job correctly uses ${{ github.token }} for the workflow-repo checkout, but safe_outputs substitutes the safe-outputs.github-app token instead.

Reproduction

Workflow in OrgA/workflow-repo targeting repos in OrgB:

checkout:
  - repository: ${{ github.event.inputs.target_org }}/${{ github.event.inputs.target_repo }}
    github-app:
      client-id: ${{ vars.APP_ID }}
      private-key: ${{ secrets.APP_PRIVATE_KEY }}
      owner: ${{ github.event.inputs.target_org }}
      repositories: ["${{ github.event.inputs.target_repo }}"]
    fetch-depth: 0
    current: true

safe-outputs:
  github-app:
    client-id: ${{ vars.APP_ID }}
    private-key: ${{ secrets.APP_PRIVATE_KEY }}
    owner: ${{ github.event.inputs.target_org }}
    repositories: ["${{ github.event.inputs.target_repo }}"]
  create-pull-request:
    target-repo: ${{ github.event.inputs.target_org }}/${{ github.event.inputs.target_repo }}

The GitHub App is installed on both orgs.

Compiled output (v0.81.6)

In the safe_outputs job:

# Token minted for OrgB (target org)
- name: Generate GitHub App token
  id: safe-outputs-app-token
  uses: actions/create-github-app-token@...
  with:
    owner: ${{ github.event.inputs.target_org }}   # OrgB

# Tries to checkout OrgA/workflow-repo with OrgB token → FAILS
- name: Checkout repository
  uses: actions/checkout@...
  with:
    token: ${{ steps.safe-outputs-app-token.outputs.token }}

# Checks out OrgB/target-repo with checkout manifest token → works
- name: Checkout OrgB/target-repo
  uses: actions/checkout@...
  with:
    repository: OrgB/target-repo
    token: ${{ steps.checkout-app-token-0.outputs.token }}

Error

could not read Username for 'https://github.com': terminal prompts disabled
The process '/usr/bin/git' failed with exit code 128

Expected behavior

When safe-outputs.github-app is scoped to a target org (via owner: or owner derivation) and create-pull-request.target-repo points to that org, the safe_outputs job should not generate a checkout step for the workflow repo. The minted app token is scoped to the target org — the safe_outputs job should only operate within that scope. It only needs the target repo checked out to apply patches and create the PR.

The auth docs explicitly support multi-org workflows: "This lets multi-org workflows mint App tokens against the effective target without setting owner: explicitly" (auth reference). The current compiler behavior breaks this by attempting to checkout the workflow repo with a token that is intentionally scoped to a different org.

Workaround attempts

Approach	Result
safe-outputs.github-app with owner: target_org	"Checkout repository" fails — token can't access workflow repo
No safe-outputs auth (rely on GITHUB_TOKEN)	Checkouts work, but Process Safe Outputs fails — GITHUB_TOKEN can't access target org API
create-pull-request.github-token via custom job	Compiler uses this token for "Checkout repository" too (highest priority per docs)
safe-outputs.github-token with PAT	Works, but requires a PAT — defeats the purpose of github-app

No workaround exists using only github-app auth for cross-org create-pull-request with target-repo.

Related

• safe_outputs: always use the same checkout layout as the agent job (not only for target-repo: "*") #40121 — safe_outputs checkout layout divergence (related but distinct: layout vs token)

Environment

• gh-aw v0.81.6

[pelikhan]

@copilot safeoutputs app or token should NOT be used to checkout in tbe safeoutputs job.

[pelikhan]

@holwerda use checkout....safe-outputs-github-app: .. to configure the checkout in the safe-outputs job in v0.82.7+