Add `github-token-for-extra-empty-commit: none` to keep GH_AW_CI_TRIGGER_TOKEN out of compiled workflows by Copilot · Pull Request #62416 · github/gh-aw

Copilot · 2026-09-21T17:59:53Z

Compiled lock files always reference GH_AW_CI_TRIGGER_TOKEN — in the Process Safe Outputs step env and in the gh-aw-manifest header — whenever create-pull-request or push-to-pull-request-branch is configured, even for repositories that deliberately do not define the secret. The reference resolves to an empty string at runtime and the empty commit is skipped, but the lock file still reads as if the token is expected.

The issue asks for the token to be dropped automatically when permissions.copilot-requests: write is present. That conflates two unrelated tokens: copilot-requests: write removes the need for a COPILOT_GITHUB_TOKEN PAT for inference, while GH_AW_CI_TRIGGER_TOKEN is what pushes the extra empty commit that starts CI (GITHUB_TOKEN pushes never trigger workflows). 45 workflows in this repo use both, and auto-omission would silently stop CI from triggering on their PRs. This PR adds an explicit opt-out instead.

Compiler

addCITriggerTokenEnvVar extracted from addSafeOutputTokenEnvVars, with a none case that emits no env var at all — removing the secret from both the step and the manifest.
app/none sentinels are now matched case-insensitively (trimmed + lowercased) so None/App are not treated as literal token values; custom token expressions keep their original casing.

Schema & docs

Schema descriptions for both safe outputs document none; generated frontmatter-full.md entries updated to match.
triggering-ci.mdx: new "Disabling the extra empty commit" section, plus a note that GH_AW_CI_TRIGGER_TOKEN is unrelated to Copilot inference billing.

Tests

TestCITriggerTokenNoneOmitsSecret asserts the token is absent from the lock file body and from gh-aw-manifest secrets for create-pull-request, push-to-pull-request-branch, and mixed casing.

safe-outputs:
  create-pull-request:
    github-token-for-extra-empty-commit: none   # no GH_AW_CI_TRIGGER_TOKEN in the lock file

Default behavior is unchanged: make recompile produces no diffs across the 299 existing lock files.

Note for reviewers: when both PR safe outputs are configured with conflicting values, create-pull-request still wins, matching the existing precedence for app/custom tokens. Tightening that (or erroring on conflicts) is deliberately left out of scope.

Fixes GH_AW_CI_TRIGGER_TOKEN still emitted in compiled lock file even when PAT is no longer required #62045

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 41.9 AIC · ⊞ 9.1K · ◷
_{Comment /souschef to run again}

…-extra-empty-commit: none Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Copilot review overview

🟡 Changes recommended

The opt-out can be bypassed by safe-outputs.env, and the documentation and release classification need correction.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1 · 2

Open (3)

Filter or reject env override when none disables extra commit · New
Add minor changeset for new configuration behavior · New
Clarify none only disables the extra empty commit · New

What changed in this PR

Adds an explicit opt-out for CI-triggering empty commits and removes the unused token reference from compiled workflows.

Changes:

Adds case-insensitive none and app handling.
Updates schemas, reference documentation, and release notes.
Tests token omission for both PR safe outputs.

File	Description
`pkg/workflow/push_to_pull_request_branch.go`	Documents the `none` option.
`pkg/workflow/create_pull_request.go`	Documents the `none` option.
`pkg/workflow/create_pull_request_ci_trigger_token_test.go`	Tests token omission.
`pkg/workflow/compiler_safe_outputs_steps.go`	Implements sentinel handling.
`pkg/parser/schemas/main_workflow_schema.json`	Updates schema descriptions.
`docs/src/content/docs/reference/triggering-ci.mdx`	Documents disabling empty commits.
`docs/src/content/docs/reference/frontmatter-full.md`	Updates generated reference text.
`.changeset/ci-trigger-token-none.md`	Records the release change.

+	case "none":
+		// Explicitly opt out of the extra empty commit: no token env var is emitted, so the
+		// magic GH_AW_CI_TRIGGER_TOKEN secret is absent from both the compiled step and the
+		// gh-aw-manifest. The handler skips the empty commit at runtime.


+    github-token-for-extra-empty-commit: none
+```
+
+With `none`, no `GH_AW_CI_TRIGGER_TOKEN` environment variable is emitted and CI checks will not be triggered on the created or updated pull request branch.


github-actions · 2026-09-21T18:49:49Z

⚠️ Security scanning failed for Design Decision Gate 🏗️. Review the logs for details.

🏗️ ADR gate enforced by Design Decision Gate 🏗️

github-actions · 2026-09-21T18:49:52Z

⚠️ PR Code Quality Reviewer failed during code quality review.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🔎 Code quality review by PR Code Quality Reviewer

github-actions · 2026-09-21T18:50:04Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

github-actions · 2026-09-21T18:50:31Z

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel skipped because pre-fetch PR data was unavailable: unable to fetch test file diff

🧪 Test quality analysis by Test Quality Sentinel

github-actions · 2026-09-21T18:50:38Z

✅ Ponytail Reviewer completed successfully!

Lean already. Ship.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

Generated by Ponytail Reviewer for #62416

github-actions · 2026-09-21T18:55:05Z

🏗️ ADR required — draft added for PR #62416

Result

A draft ADR has been added to this PR because ADR enforcement is required and no existing ADR was found in the PR body or docs/adr/ on the branch.

Evidence used

Enforcement triggered because this PR adds 120 lines in default business logic directories (pkg/), which is above the 100-line threshold.
PR description explains an architectural choice: add an explicit github-token-for-extra-empty-commit: none opt-out instead of inferring behavior from permissions.copilot-requests: write.
Diff changes compiler behavior in pkg/workflow/compiler_safe_outputs_steps.go, schema/docs, and regression tests.

Draft ADR added

docs/adr/62416-add-explicit-opt-out-for-ci-trigger-token-emission.md

Next action for the author

Please review and refine the draft ADR, especially the trade-offs and decision wording, before merging this PR.

🏗️ ADR gate enforced by Design Decision Gate 🏗️ · pi · gpt54 · 18.1 AIC · ⊞ 9.9K · ◷
_{Comment /review to run again}

github-actions

Skills-Based Review 🧠

Applied /diagnosing-bugs, /tdd, and /codebase-design (triage: bug_fix / feature-opt-out). Requesting changes: one real correctness gap plus two smaller doc/changeset fixes already flagged by the earlier Copilot review, which I concur with.

📋 Key Themes & Highlights

Key Themes

Correctness gap (highest impact): addCITriggerTokenEnvVar's none case only suppresses the compiler-generated GH_AW_CI_TRIGGER_TOKEN line. addSafeOutputCoreEnvVars runs first in the same env: block and independently emits any safe-outputs.env entries verbatim, so a workflow with both github-token-for-extra-empty-commit: none and safe-outputs.env.GH_AW_CI_TRIGGER_TOKEN: <secret> would still leak the secret reference into the lock file — the exact outcome this PR exists to prevent. No test covers this combination.
Changeset semver: marked patch, but this adds a new, backward-compatible public config value/behavior (none), which per .github/skills/developer-release/SKILL.md should be minor.
Docs overstatement: the new "Disabling the extra empty commit" section says CI "will not be triggered" with none, but the full github-token override documented right below it triggers CI via the primary push regardless of this setting — worth a caveat.

Positive Highlights

✅ Clean extraction of addCITriggerTokenEnvVar out of addSafeOutputTokenEnvVars, improving single-responsibility and testability (/codebase-design).
✅ Case-insensitive sentinel matching (app/none) while preserving original casing for custom token expressions is a thoughtful, low-risk touch.
✅ TestCITriggerTokenNoneOmitsSecret is solid TDD coverage for the primary scenarios (create-pull-request, push-to-pull-request-branch, mixed-case None), verifying both the lock file body and the gh-aw-manifest secrets list.
✅ Confirmed no lock-file diffs across 299 existing workflows — good regression discipline for a compiler change.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet50 · 88.8 AIC · ⌖ 14.8 AIC · ⊞ 10.1K
_{Comment /matt to run again}

github-actions · 2026-09-21T18:59:39Z

@@ -0,0 +1,5 @@
+---
+"gh-aw": patch


[/codebase-design] Agreeing with the existing Copilot review comment: this changeset is marked patch, but per the repo's own release guidance (.github/skills/developer-release/SKILL.md), a new backward-compatible option like github-token-for-extra-empty-commit: none is a feature and should be minor.

💡 Suggested fix

--- -"gh-aw": patch +"gh-aw": minor ---

@copilot please address this.

Updated the changeset to minor in 6e44b32.

github-actions · 2026-09-21T18:59:39Z

+    github-token-for-extra-empty-commit: none
+```
+
+With `none`, no `GH_AW_CI_TRIGGER_TOKEN` environment variable is emitted and CI checks will not be triggered on the created or updated pull request branch.


[/grill-with-docs] Agreeing with the existing Copilot review comment: "CI checks will not be triggered on the created or updated pull request branch" is too absolute — it's only true when github-token (full override) isn't also set, since that path pushes directly with a real token and triggers CI regardless of this empty-commit setting.

💡 Suggested rewording

Something like: "With none, no GH_AW_CI_TRIGGER_TOKEN environment variable is emitted, so the extra empty commit used to trigger CI is skipped (unless the full github-token override below is also configured, in which case the primary push already triggers CI)."

@copilot please address this.

Clarified in 6e44b32 that none skips only the extra empty commit; a full github-token override still triggers CI via the primary push.

github-actions · 2026-09-21T18:59:39Z

+	case "none":
+		// Explicitly opt out of the extra empty commit: no token env var is emitted, so the
+		// magic GH_AW_CI_TRIGGER_TOKEN secret is absent from both the compiled step and the
+		// gh-aw-manifest. The handler skips the empty commit at runtime.


[/diagnosing-bugs] Agreeing with the existing Copilot review comment: none only suppresses the compiler-generated GH_AW_CI_TRIGGER_TOKEN line, but addSafeOutputCoreEnvVars → addCustomSafeOutputEnvVars runs earlier in the same env: block and will still emit a raw safe-outputs.env.GH_AW_CI_TRIGGER_TOKEN: <value> line if a user configures it there, silently reintroducing the exact secret this PR is meant to let repos opt out of.

💡 Suggested fix

Have addCITriggerTokenEnvVar (or addCustomSafeOutputEnvVars) skip/warn on GH_AW_CI_TRIGGER_TOKEN when the sentinel is none, and add a regression test that sets safe-outputs.env.GH_AW_CI_TRIGGER_TOKEN alongside github-token-for-extra-empty-commit: none and asserts the secret is still absent from the lock file.

@copilot please address this.

Fixed in 6e44b32 by filtering a custom GH_AW_CI_TRIGGER_TOKEN whenever the effective option is none; regression coverage now includes both PR safe-output paths in 122ee48.

gh-aw-bot · 2026-09-21T19:04:18Z

pr-sous-chef
@copilot This PR still needs forward progress before a maintainer can merge it.

Please address the open review follow-ups below, refresh the branch if needed, and then run the pr-finisher skill.

Open review follow-ups (newest first):

github-actions[bot] review summary: Add github-token-for-extra-empty-commit: none to keep GH_AW_CI_TRIGGER_TOKEN out of compiled workflows #62416 (review)
Copilot review overview: Add github-token-for-extra-empty-commit: none to keep GH_AW_CI_TRIGGER_TOKEN out of compiled workflows #62416 (review)

I also requested a branch refresh for this PR.
Run: https://github.com/github/gh-aw/actions/runs/35641565679

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 41.9 AIC · ⊞ 9.1K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-09-21T19:39:20Z

pr-sous-chef
@copilot This PR still needs forward progress before a maintainer can merge it.
...

Addressed all directed review follow-ups, refreshed from main, completed pr-finisher validation, and pushed the fixes through c81478e. Full lint, tests, and workflow recompilation pass; the incremental report target only reports pre-existing custom-linter baseline findings.

Done

Document the github-token-for-extra-empty-commit: none option (#62416) in safe-outputs-content.md and safe-outputs-management.md, which was missing from both the create-pull-request and push-to-pull-request-branch references. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

github-actions · 2026-09-23T04:52:14Z

🎉 This pull request is included in a new release.

Release: v0.89.20

Initial plan

5d51672

Copilot AI assigned Copilot and pelikhan Sep 21, 2026

Copilot started work on behalf of pelikhan September 21, 2026 18:00 View session

Copilot AI linked an issue Sep 21, 2026 that may be closed by this pull request

GH_AW_CI_TRIGGER_TOKEN still emitted in compiled lock file even when PAT is no longer required #62045

Closed

Copilot AI and others added 2 commits September 21, 2026 18:17

Allow disabling GH_AW_CI_TRIGGER_TOKEN emission with github-token-for…

ab33772

…-extra-empty-commit: none Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Match app/none CI trigger token sentinels case-insensitively

b3b1d6a

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix GH_AW_CI_TRIGGER_TOKEN emission in compiled lock file~~ Add github-token-for-extra-empty-commit: none to keep GH_AW_CI_TRIGGER_TOKEN out of compiled workflows Sep 21, 2026

Copilot finished work on behalf of pelikhan September 21, 2026 18:20

Copilot AI requested a review from pelikhan September 21, 2026 18:20

pelikhan marked this pull request as ready for review September 21, 2026 18:28

Copilot AI balanced review requested due to automatic review settings September 21, 2026 18:28

Copilot started reviewing on behalf of pelikhan September 21, 2026 18:29 View session

Copilot AI reviewed Sep 21, 2026

View reviewed changes

Add ADR for CI trigger token opt-out

bf185e4

github-actions Bot added the needs-review label Sep 21, 2026

github-actions Bot previously requested changes Sep 21, 2026

View reviewed changes

Merge branch 'main' into copilot/fix-gh-aw-ci-trigger-token-emission

f4b91b7

github-actions Bot mentioned this pull request Sep 21, 2026

[pr-sous-chef] PR Sous Chef run report #62242

Closed

Copilot started work on behalf of gh-aw-bot September 21, 2026 19:08 View session

Copilot AI and others added 3 commits September 21, 2026 19:16

Address CI trigger token review feedback

6e44b32

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Guard CI trigger token resolution for nil config

97112ae

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Document CI trigger token precedence

bcb0d6f

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot AI and others added 4 commits September 21, 2026 19:31

Cover push branch token opt-out collision

122ee48

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Simplify CI token opt-out filtering

b4a7842

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Lock in CI token conflict precedence

cf21367

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Clarify CI token precedence expectation

c81478e

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot September 21, 2026 19:40

Copilot AI requested a review from gh-aw-bot September 21, 2026 19:40

pelikhan merged commit 0d0e2b4 into main Sep 21, 2026
35 checks passed

pelikhan deleted the copilot/fix-gh-aw-ci-trigger-token-emission branch September 21, 2026 21:48

This was referenced Sep 22, 2026

[instructions] Sync instruction files with release v0.89.17 #62592

Merged

Suggested test: copilot/create-pull-request-github-token-none githubnext/gh-aw-test#17293

Open

[docs] Update glossary - daily scan #62610

Merged

Conversation

Copilot AI commented Sep 21, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Compiler

Schema & docs

Tests

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

github-actions Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 21, 2026

Result

Evidence used

Draft ADR added

Next action for the author

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review 🧠

Key Themes

Positive Highlights

Uh oh!

github-actions Bot Sep 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 21, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Sep 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 21, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Sep 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 21, 2026

Choose a reason for hiding this comment

Uh oh!

gh-aw-bot commented Sep 21, 2026

Uh oh!

Copilot AI commented Sep 21, 2026

Uh oh!

Uh oh!

github-actions Bot commented Sep 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Sep 21, 2026 •

edited by github-actions Bot

Loading

github-actions Bot commented Sep 21, 2026 •

edited

Loading

github-actions Bot commented Sep 21, 2026 •

edited

Loading

github-actions Bot commented Sep 21, 2026 •

edited

Loading

github-actions Bot commented Sep 21, 2026 •

edited

Loading

github-actions Bot commented Sep 21, 2026 •

edited

Loading