Add support for top-level github-token configuration in workflow frontmatter

[Copilot]

Add support for top-level github-token field in frontmatter

Plan

• Update main_workflow_schema.json to add github-token field at top level
• Update WorkflowData struct to include GitHubToken field
• Parse github-token from frontmatter in compiler
• Update checkout step generation to use custom github-token if provided
• Update engine configurations (claude, codex, copilot, custom) to use custom github-token
• Ensure safe-outputs github-token takes precedence over top-level github-token
• Ensure individual safe-output github-token takes precedence over safe-outputs github-token
• Fix all failing unit tests
• Add integration tests for top-level github-token precedence
• Update security.md documentation
• Run all tests to ensure no regressions
• Move getEffectiveGitHubToken to github_token.go

Summary

Successfully implemented top-level github-token field with complete precedence hierarchy:

1. Individual safe-output github-token (highest priority) - e.g., create-issue.github-token
2. Safe-outputs global github-token - e.g., safe-outputs.github-token
3. Top-level github-token (new) - e.g., github-token: ${{ secrets.CUSTOM_PAT }}
4. Default fallback - ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}

Recent Changes

• Moved getEffectiveGitHubToken() helper function to new github_token.go file for better code organization

Key Features

• Flexible token management: Set a default token for the entire workflow while allowing specific safe-outputs to override
• Engine integration: Token is automatically used in all engine configurations (claude, codex, copilot, custom)
• Checkout integration: Token is used in checkout steps in trial mode
• Safe-outputs integration: Proper precedence ensures individual safe-output tokens override global settings

Testing

• ✅ All unit tests pass
• ✅ All integration tests pass
• ✅ New integration test verifies precedence hierarchy across all engines
• ✅ Security documentation updated with examples

Original prompt

Add support in front matter to configure a "github-token" expression at the top level.

---

github-token: ${{ secrets.... }}
...

If defined, this expression is used to set the value of the GITHUB_TOKEN env in all steps that require a github token.

This expression can be overridden by the safe-outputs github-token and by the safe-output children (create-issue) github-token field.

• update schema
• review codegen for actions/checkout, agentic engine secrets
• update security.md docs on authentication

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[pelikhan]

@copilot move to github_token.go

[Copilot]

Moved to pkg/workflow/github_token.go in commit 3f5e8ac

[github-actions]

Agentic Changeset Generator triggered by this pull request.