resolvePRCheckoutToken returns the token to use for PR checkout and git operations. Applies the following precedence (highest to lowest): 1. Per-config PAT: create-pull-request.github-token 2. Per-config PAT: push-to-pull-request-branch.github-token 3. GitHub App minted token (if a github-app is con
(safeOutputs *SafeOutputsConfig)
| 128 | // - token: the effective GitHub Actions token expression to use for git operations |
| 129 | // - isCustom: true when a custom non-default token was explicitly configured (per-config PAT, app, or safe-outputs PAT) |
| 130 | func resolvePRCheckoutToken(safeOutputs *SafeOutputsConfig) (token string, isCustom bool) { |
| 131 | if safeOutputs == nil { |
| 132 | return getEffectiveSafeOutputGitHubToken(""), false |
| 133 | } |
| 134 | |
| 135 | var createPRToken string |
| 136 | if safeOutputs.CreatePullRequests != nil { |
| 137 | createPRToken = safeOutputs.CreatePullRequests.GitHubToken |
| 138 | } |
| 139 | var pushToPRBranchToken string |
| 140 | if safeOutputs.PushToPullRequestBranch != nil { |
| 141 | pushToPRBranchToken = safeOutputs.PushToPullRequestBranch.GitHubToken |
| 142 | } |
| 143 | |
| 144 | // Per-config PAT tokens take highest precedence (overrides GitHub App) |
| 145 | perConfigToken := createPRToken |
| 146 | if perConfigToken == "" { |
| 147 | perConfigToken = pushToPRBranchToken |
| 148 | } |
| 149 | if perConfigToken != "" { |
| 150 | return getEffectiveSafeOutputGitHubToken(perConfigToken), true |
| 151 | } |
| 152 | |
| 153 | // GitHub App token takes precedence over the safe-outputs level PAT |
| 154 | if safeOutputs.GitHubApp != nil { |
| 155 | if safeOutputs.GitHubApp.shouldIgnoreMissingKey() { |
| 156 | return combineTokenExpressions( |
| 157 | "${{ steps.safe-outputs-app-token.outputs.token }}", |
| 158 | getEffectiveSafeOutputGitHubToken(safeOutputs.GitHubToken), |
| 159 | ), true |
| 160 | } |
| 161 | //nolint:gosec // G101: False positive - this is a GitHub Actions expression template placeholder, not a hardcoded credential |
| 162 | return "${{ steps.safe-outputs-app-token.outputs.token }}", true |
| 163 | } |
| 164 | |
| 165 | if safeOutputs.GitHubToken != "" { |
| 166 | return getEffectiveSafeOutputGitHubToken(safeOutputs.GitHubToken), true |
| 167 | } |
| 168 | |
| 169 | return getEffectiveSafeOutputGitHubToken(""), false |
| 170 | } |
| 171 | |
| 172 | // resolveStaticCheckoutToken returns the effective checkout token as a static GitHub Actions |
| 173 | // expression (secret reference or default). Unlike resolvePRCheckoutToken, this function |
no test coverage detected