Move all github-app token minting to activation job#24251
Draft
Move all github-app token minting to activation job#24251
Conversation
- generateGitHubMCPAppTokenMintingSteps now returns []string for use in buildActivationJob instead of writing to a strings.Builder - activation job mints github-mcp-app-token and exposes it via output github_mcp_app_token so app-id/private-key never reach the agent job - remove generateGitHubMCPAppTokenMintingStep call from compiler_yaml_main_job.go - update generateGitHubMCPAppTokenInvalidationStep to reference needs.activation.outputs.github_mcp_app_token instead of step output - update mcp_environment.go and copilot_engine_execution.go to consume GITHUB_MCP_SERVER_TOKEN from needs.activation.outputs.github_mcp_app_token - update tests to assert new activation-output pattern Agent-Logs-Url: https://github.com/github/gh-aw/sessions/60528c57-92cc-4bc2-a14d-48ec635b7922 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot created this pull request from a session on behalf of
pelikhan
April 3, 2026 05:26
View session
Collaborator
|
@copilot also migrate top level |
…tivation job - Move safe-outputs.github-app token minting from safe_outputs + conclusion jobs to the activation job; expose as safe_outputs_app_token + safe_outputs_app_token_minting_failed outputs - Update buildGitHubAppTokenInvalidationStep to accept a tokenExpr parameter so callers (safe_outputs, conclusion, checkout) can each use their own token reference - Update all steps.safe-outputs-app-token.outputs.token references to needs.activation.outputs.safe_outputs_app_token across: safe_outputs_config_helpers.go, safe_outputs_env.go, compiler_safe_outputs_steps.go, create_code_scanning_alert.go, safe_outputs_jobs.go - Add activation to safe_outputs job needs when safe-outputs.github-app is configured (required to access needs.activation.outputs.*) - Remove minting from compiler_safe_outputs_job.go and notify_comment.go; keep invalidation in both jobs pointing to activation output - Update GH_AW_CONCLUSION_APP_TOKEN_MINTING_FAILED to reference activation output rather than the now-gone step outcome - Remove redundant inline invalidation logic from generateGitHubMCPAppTokenInvalidationStep (now uses shared helper) - Update all test assertions to reflect the new token flow Agent-Logs-Url: https://github.com/github/gh-aw/sessions/0c514f57-c2f0-4257-85f5-ef3a2cb2e579 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in 70cfcbc. All three remaining github-app configurations have been migrated:
Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Copilot
AI
changed the title
Move tools.github.github-app token minting to activation job
Move all github-app token minting to activation job
Apr 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
app-idandprivate-keysecrets for allgithub-appconfigurations were being consumed in downstream jobs (agent, safe_outputs, conclusion) to mint tokens. Moving all minting to the activation job ensures these secrets never reach downstream jobs; only the short-lived tokens are passed through as job outputs.Changes
tools.github.github-appcompiler_activation_job.go— callsgenerateGitHubMCPAppTokenMintingStepswhenParsedTools.GitHub.GitHubAppis set; exposes the result asoutputs["github_mcp_app_token"]compiler_github_mcp_steps.go—generateGitHubMCPAppTokenMintingStep(builder sink) replaced bygenerateGitHubMCPAppTokenMintingSteps(returns[]string); invalidation step now referencesneeds.activation.outputs.github_mcp_app_tokencompiler_yaml_main_job.go— removes the minting call from the agent job stepsmcp_environment.go,copilot_engine_execution.go—GITHUB_MCP_SERVER_TOKENset to${{ needs.activation.outputs.github_mcp_app_token }}when app is configuredsafe-outputs.github-app(and top-levelgithub-appfallback)compiler_activation_job.go— mintssafe-outputs-app-tokenstep whenSafeOutputs.GitHubAppis set; exposes asoutputs["safe_outputs_app_token"]andoutputs["safe_outputs_app_token_minting_failed"]compiler_safe_outputs_job.go— removes minting; adds activation toneedswhen github-app is configured; invalidation now referencesneeds.activation.outputs.safe_outputs_app_tokennotify_comment.go— removes minting from conclusion job; invalidation and failure tracking reference activation outputssteps.safe-outputs-app-token.outputs.tokenreferences updated toneeds.activation.outputs.safe_outputs_app_tokenacrosssafe_outputs_config_helpers.go,safe_outputs_env.go,compiler_safe_outputs_steps.go,create_code_scanning_alert.go,safe_outputs_jobs.gosafe_outputs_app_config.go—buildGitHubAppTokenInvalidationStepnow accepts atokenExpr stringparameter so each job (safe_outputs, conclusion, checkout) uses its own token referenceon.github-appAlready exclusively minted in the activation and pre-activation jobs — no change needed.
Result