safe-outputs: configured GH_AW_GITHUB_TOKEN shadows checkout token #47156

This was generated by AI during triage.

Summary

gh-aw v0.82.14 generates safe-output checkout steps with:

token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}

If a repository has an older GH_AW_GITHUB_TOKEN secret, it shadows the
automatic repository token for every trusted safe-output checkout. A stale,
expired, SSO-unapproved, or differently scoped secret then prevents checkout of
both the private control-plane repository and a public target repository.

Version

gh aw version v0.82.14

Reproduction

Use a private control-plane repository that has GH_AW_GITHUB_TOKEN configured
and targets a different public repository:

checkout:
  - sparse-checkout: |
      .github/workflows/example.md
  - repository: owner/public-target
    path: ./target
    current: true

safe-outputs:
  github-app:
    client-id: ${{ steps.app.outputs.client-id }}
    private-key: ${{ steps.app.outputs.private-key }}
    owner: owner
    repositories: [public-target]
  create-pull-request:
    target-repo: owner/public-target

Actual result

The generated safe-output checkout uses GH_AW_GITHUB_TOKEN ahead of the
automatic token. In our repository that secret was last updated months earlier;
both mirrored checkouts fail:

fatal: could not read Username for 'https://github.com/': terminal prompts disabled

Concrete run:
https://github.com/microsoft/vscode-engineering/actions/runs/29877683511

The activation, agent, and threat-detection paths completed far enough to
produce and approve a patch. Safe outputs could not apply it.

Expected result

The trusted safe-output checkout of the workflow repository should use
${{ github.token }} by default. Authentication used for target-repository
writes should remain separately configurable through
safe-outputs.github-app/per-output tokens.

At minimum, the generated workflow should make the selected checkout credential
explicit enough to diagnose and override without replacing the write credential
or manually editing the lock file.

This also appears inconsistent with the checkout documentation, which states
that the safe-output job uses GITHUB_TOKEN for checkout and the
safe-outputs.github-app governs PR/push operations rather than control-plane
checkout.

Security relevance

The current precedence encourages a single long-lived token to cover both the
private control plane and public write targets. Separating checkout and output
credentials avoids broadening either token.