Function getEffectiveSafeOutputGitHubToken

pkg/workflow/github_token.go:39–46

getEffectiveSafeOutputGitHubToken returns the GitHub token to use for safe output operations, with precedence: 1. Custom token passed as parameter (e.g., from per-output config) 2. Default fallback: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} This simpler chain ensures safe outputs use

(customToken string)

// 2. Default fallback: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
// This simpler chain ensures safe outputs use: safe outputs token -> GH_AW_GITHUB_TOKEN -> GitHub Actions token
func getEffectiveSafeOutputGitHubToken(customToken string) string {
	if customToken != "" {
		tokenLog.Print("Using custom safe output GitHub token")
		return customToken
	}
	tokenLog.Print("Using default safe output GitHub token (GH_AW_GITHUB_TOKEN || GITHUB_TOKEN)")
	return "${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}"
}

// getEffectiveMaintenanceGitHubToken returns the configured GitHub token secret
// expression to use for maintenance compile-workflows operations.