Function resolveCheckoutTokenExpression

pkg/workflow/checkout_step_generator.go:692–706

(entry *resolvedCheckout, checkoutIndex int, defaultWhenEmpty bool)

}

func resolveCheckoutTokenExpression(entry *resolvedCheckout, checkoutIndex int, defaultWhenEmpty bool) string {
	token := entry.token
	if entry.githubApp != nil {
		// The token is minted in the agent job itself (same-job step reference).
		//nolint:gosec // G101: False positive - this is a GitHub Actions expression template placeholder, not a hardcoded credential
		token = fmt.Sprintf("${{ steps.checkout-app-token-%d.outputs.token }}", checkoutIndex)
		if entry.githubApp.shouldIgnoreMissingKey() {
			token = combineTokenExpressions(token, getEffectiveGitHubToken(entry.token))
		}
	}
	if token == "" && defaultWhenEmpty {
		token = getEffectiveGitHubToken("")
	}
	return token
}