Honor repositories: ["*"] in activation GitHub App token minting

[Copilot]

Activation GitHub App token minting did not honor the repositories: ["*"] sentinel. In reusable workflow_call flows, the activation job always scoped the token to github.event.repository.name, which broke cross-repo access needed to read the callee repo’s agent configuration.

• Compiler behavior

  • Update buildActivationAppTokenMintStep to match the existing GitHub App token minting behavior used elsewhere:
    • omit repositories: when repositories: ["*"]
    • emit a single inline repository for one explicit repo
    • emit block-scalar form for multiple repos
    • fall back to github.event.repository.name only when no repositories are configured

• Regression coverage

  • Add focused activation-job coverage asserting that the generated activation-app-token step does not include a repositories: input when the wildcard sentinel is configured

• Behavioral effect

  • repositories: ["*"] now yields org-wide installation token scope for activation steps, instead of incorrectly forcing caller-repo scope

github-app:
  app-id: "12345"
  private-key: ${{ secrets.MY_PEM }}
  repositories: ["*"]

With this change, the generated activation token step omits:

with:
  repositories: ${{ github.event.repository.name }}

so the token can access any repository where the App is installed.

[pelikhan]

@copilot update the safe outputs specification with w3c-spec-writer

[Copilot]

Pull request overview

Updates activation GitHub App token minting to honor wildcard and explicit repository scopes.

Changes:

• Omits repositories for ["*"], enabling installation-wide access.
• Supports single, multiple, and default repository scopes.
• Adds regression coverage and refreshes AWF v0.27.35 pins/workflows.

Show a summary per file

File	Description
pkg/workflow/safe_outputs_app_config.go	Implements activation repository scoping.
pkg/workflow/activation_github_token_test.go	Tests wildcard omission.
pkg/workflow/data/action_pins.json	Reorders AWF v0.27.35 pins.
pkg/actionpins/data/action_pins.json	Mirrors updated pins.
.github/workflows/smoke-ci.lock.yml	Regenerates with AWF v0.27.35.
.github/workflows/firewall.lock.yml	Regenerates with AWF v0.27.35.
.github/workflows/example-permissions-warning.lock.yml	Regenerates with AWF v0.27.35.
.github/workflows/daily-malicious-code-scan.lock.yml	Regenerates with AWF v0.27.35.
.github/workflows/codex-github-remote-mcp-test.lock.yml	Regenerates with AWF v0.27.35.
.github/workflows/bot-detection.lock.yml	Regenerates with AWF v0.27.35.
.github/workflows/ai-moderator.lock.yml	Regenerates with AWF v0.27.35.
.github/workflows/agentic-token-optimizer.lock.yml	Regenerates with AWF v0.27.35.
.github/workflows/ace-editor.lock.yml	Regenerates with AWF v0.27.35.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 33/261 changed files
• Comments generated: 0
• Review effort level: Medium

[Copilot]

@copilot update the safe outputs specification with w3c-spec-writer

Addressed in 3d5f311. Updated the safe outputs specification with a new normative github-app.repositories section covering repositories: ["*"], activation and safe-output token minting, and workflow_call behavior, plus the spec metadata/changelog updates.

[pelikhan]

@copilot merge main and recompile

[pelikhan]

@copilot merge main and recompile

[Copilot]

@copilot merge main and recompile

Done — merged main and recompiled all 257 workflows successfully (9ae29dc). The only test failures (TestLogsJSONOutputWithNoRuns, TestCloseExistingOrgIssuesByMarkerSkipsPRsAndPaginates, TestRunWorkflowOnGitHub_FlagCombinations) are pre-existing on main and unrelated to this PR.

[Copilot]

@copilot merge main and recompile

Done — merged main (401db81 - update all packages) and recompiled all 257 workflows (496c728).

[pelikhan]

@copilot fix https://github.com/github/gh-aw/actions/runs/29482462353/job/87569120370?pr=45908

[Copilot]

@copilot fix https://github.com/github/gh-aw/actions/runs/29482462353/job/87569120370?pr=45908

Fixed in the latest commit. The CI failure was caused by the update all packages commit on main removing old container/action pins from action_pins.json. Updated test references across pkg/workflow and pkg/actionpins:

• Firewall version 0.27.0 → 0.27.35 (in docker_firewall_pin_compile_test.go, awf_helpers_test.go, docker_pin_test.go)
• Removed agent-act and build-tools assertions (these images are no longer in the embedded pin data)
• actions/setup-node and actions/setup-go expected versions updated to v7.0.0
• ghcr.io/github/gh-aw-mcpg references updated from v0.3.6/v0.3.9 to v0.4.1

All pkg/workflow and pkg/actionpins tests pass. The only remaining failures (TestLogsJSONOutputWithNoRuns, TestCloseExistingOrgIssuesByMarkerSkipsPRsAndPaginates, TestRunWorkflowOnGitHub_FlagCombinations) are pre-existing on main and unrelated to this PR.

[pelikhan]

@copilot merge main and recompile

[Copilot]

@copilot merge main and recompile

Done — merged main and recompiled all 257 workflows successfully (0 errors). Resolved test conflicts by adopting main's constants-based approach (constants.DefaultFirewallVersion, constants.DefaultMCPGatewayVersion) instead of hardcoded version strings.

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.82.11