resolveStaticCheckoutToken returns the effective checkout token as a static GitHub Actions expression (secret reference or default). Unlike resolvePRCheckoutToken, this function never returns a step-output expression because step outputs are not accessible outside the job they were created in. Toke
(safeOutputs *SafeOutputsConfig, checkoutMgr *CheckoutManager)
| 181 | // 4. safe-outputs.github-token |
| 182 | // 5. Default fallback (GH_AW_GITHUB_TOKEN || GITHUB_TOKEN) |
| 183 | func resolveStaticCheckoutToken(safeOutputs *SafeOutputsConfig, checkoutMgr *CheckoutManager) string { |
| 184 | if checkoutMgr != nil { |
| 185 | override := checkoutMgr.GetDefaultCheckoutOverride() |
| 186 | if override != nil && override.token != "" { |
| 187 | return getEffectiveSafeOutputGitHubToken(override.token) |
| 188 | } |
| 189 | } |
| 190 | |
| 191 | if safeOutputs == nil { |
| 192 | return getEffectiveSafeOutputGitHubToken("") |
| 193 | } |
| 194 | |
| 195 | if safeOutputs.CreatePullRequests != nil && safeOutputs.CreatePullRequests.GitHubToken != "" { |
| 196 | return getEffectiveSafeOutputGitHubToken(safeOutputs.CreatePullRequests.GitHubToken) |
| 197 | } |
| 198 | if safeOutputs.PushToPullRequestBranch != nil && safeOutputs.PushToPullRequestBranch.GitHubToken != "" { |
| 199 | return getEffectiveSafeOutputGitHubToken(safeOutputs.PushToPullRequestBranch.GitHubToken) |
| 200 | } |
| 201 | if safeOutputs.GitHubToken != "" { |
| 202 | return getEffectiveSafeOutputGitHubToken(safeOutputs.GitHubToken) |
| 203 | } |
| 204 | |
| 205 | return getEffectiveSafeOutputGitHubToken("") |
| 206 | } |
| 207 | |
| 208 | // resolveProjectToken resolves the project token using precedence: |
| 209 | // 1. Per-config token (e.g., update-project/create-project/create-project-status-update) |
no test coverage detected