[gh-aw] Eliminate magic GH_AW_* secret references from lock files

[jonathanpeppers]

---

Pull Request
title and
description
should follow the
commit-messages.md workflow documentation, and in particular should include:

• Useful description of why the change is necessary.
• Links to issues fixed
• Unit tests — N/A (workflow config only; verified by gh aw compile which reports 0 errors / 0 warnings)

Why

The dotnet/android secret-audit report flags every secret name that appears in a compiled gh-aw workflow, including the "magic" fallback secrets that gh-aw bakes into every token-resolution chain (GH_AW_GITHUB_TOKEN and GH_AW_GITHUB_MCP_SERVER_TOKEN). Those names showed up in both *.lock.yml files even though we never set those secrets in the copilot-pr-reviewer environment, because gh-aw emits the full fallback expression as the default in every safe-output handler and in the GitHub MCP server wiring.

Approach

Set explicit github-token: ${{ secrets.GITHUB_TOKEN }} overrides at two levels in both nightly-fix-finder.md and android-reviewer.md so the compiler short-circuits both fallback chains before they reference the magic names:

• safe-outputs.github-token replaces the safe-output.github-token → GH_AW_AGENT_TOKEN → GH_AW_GITHUB_TOKEN → GITHUB_TOKEN chain used by safe-output handlers (create-issue, create-pull-request-review-comment, submit-pull-request-review).
• tools.github.github-token replaces the GH_AW_GITHUB_MCP_SERVER_TOKEN → GH_AW_GITHUB_TOKEN → GITHUB_TOKEN chain used by the GitHub MCP server container.

The existing assign-to-agent.github-token: ${{ secrets.ANDROID_TEAM_PAT }} override in the nightly workflow is left alone — the Copilot assignment API requires a user-owned fine-grained PAT and rejects GITHUB_TOKEN.

Why GITHUB_TOKEN (not COPILOT_GITHUB_TOKEN)

COPILOT_GITHUB_TOKEN is scoped to "Copilot Requests: Read" only — it has no issues: write / pull-requests: write scopes and would 403 on every safe-output write. The safe-output processing jobs that gh-aw generates run with their own elevated permissions: block, so the built-in GITHUB_TOKEN already has exactly the scopes they need.

Result

After recompiling, the # Secrets used: block (and the machine-readable gh-aw-manifest: JSON) in each lock file lists only secrets that are actually configured in the copilot-pr-reviewer environment:

Lock file	Before	After
nightly-fix-finder.lock.yml	ANDROID_TEAM_PAT, COPILOT_GITHUB_TOKEN, GH_AW_GITHUB_MCP_SERVER_TOKEN, GH_AW_GITHUB_TOKEN, GITHUB_TOKEN	ANDROID_TEAM_PAT, COPILOT_GITHUB_TOKEN, GITHUB_TOKEN
android-reviewer.lock.yml	COPILOT_GITHUB_TOKEN, GH_AW_GITHUB_MCP_SERVER_TOKEN, GH_AW_GITHUB_TOKEN, GITHUB_TOKEN	COPILOT_GITHUB_TOKEN, GITHUB_TOKEN

No stray GH_AW_GITHUB_TOKEN or GH_AW_GITHUB_MCP_SERVER_TOKEN strings remain anywhere in the lock-file bodies. gh aw compile reports 0 errors / 0 warnings on both workflows.

[Copilot]

Pull request overview

This PR updates the gh-aw workflow source files so the generated lock workflows no longer contain references to gh-aw’s “magic” fallback secret names (GH_AW_GITHUB_TOKEN, GH_AW_GITHUB_MCP_SERVER_TOKEN). This reduces false positives in secret-audit output while keeping the workflows functionally equivalent (they were already falling back to GITHUB_TOKEN when the magic secrets were unset).

Changes:

• Add explicit github-token: ${{ secrets.GITHUB_TOKEN }} overrides to safe-outputs and to tools.github in both workflows.
• Regenerate both *.lock.yml files so compiled output (and the # Secrets used: manifest) no longer includes the gh-aw magic secret names.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
.github/workflows/nightly-fix-finder.md	Sets explicit safe-outputs.github-token and tools.github.github-token to short-circuit gh-aw fallback chains.
.github/workflows/nightly-fix-finder.lock.yml	Regenerated compiled workflow; removes GH_AW_* secret-name references from expressions and manifest.
.github/workflows/android-reviewer.md	Sets explicit tools.github.github-token and safe-outputs.github-token to avoid magic secret-name fallbacks.
.github/workflows/android-reviewer.lock.yml	Regenerated compiled workflow; removes GH_AW_* secret-name references from expressions and manifest.