fix: exempt secrets.GITHUB_TOKEN from steps validation and recompile workflows

Copilot · pelikhan · web-flow · commit 080a35a8108b · 2026-04-04T06:54:25.000Z
GITHUB_TOKEN is GitHub's built-in runner token, not a user-defined secret. Exempt it from the steps/post-steps secrets validation so existing workflows using `GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}` in custom steps continue to compile. Add filterBuiltinTokens helper and update tests accordingly. Recompile all 184 workflow lock files with the updated binary. Agent-Logs-Url: https://github.com/github/gh-aw/sessions/a6405a5b-b8da-42ad-9724-cd95d533d211 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
diff --git a/pkg/workflow/strict_mode_steps_validation.go b/pkg/workflow/strict_mode_steps_validation.go
@@ -53,6 +53,10 @@ func (c *Compiler) validateStepsSectionSecrets(frontmatter map[string]any, secti
 		secretRefs = append(secretRefs, refs...)
 	}
 
+	// Filter out the built-in GITHUB_TOKEN: it is already present in every runner
+	// environment and is not a user-defined secret that could be accidentally leaked.
+	secretRefs = filterBuiltinTokens(secretRefs)
+
 	if len(secretRefs) == 0 {
 		strictModeValidationLog.Printf("No secrets found in %s section", sectionName)
 		return nil
@@ -117,3 +121,17 @@ func deduplicateStringSlice(in []string) []string {
 	}
 	return out
 }
+
+// filterBuiltinTokens removes secret expressions that reference GitHub's built-in
+// GITHUB_TOKEN from the list. GITHUB_TOKEN is automatically provided by the runner
+// environment and is not a user-defined secret; it therefore does not represent an
+// accidental leak into the agent job.
+func filterBuiltinTokens(refs []string) []string {
+	out := refs[:0:0]
+	for _, ref := range refs {
+		if !strings.Contains(ref, "secrets.GITHUB_TOKEN") {
+			out = append(out, ref)
+		}
+	}
+	return out
+}
diff --git a/pkg/workflow/strict_mode_steps_validation_test.go b/pkg/workflow/strict_mode_steps_validation_test.go
@@ -38,6 +38,22 @@ func TestValidateStepsSecrets(t *testing.T) {
 			strictMode:  true,
 			expectError: false,
 		},
+		{
+			name: "steps with GITHUB_TOKEN are allowed (built-in token is exempt)",
+			frontmatter: map[string]any{
+				"steps": []any{
+					map[string]any{
+						"name": "Use GH CLI",
+						"env": map[string]any{
+							"GH_TOKEN": "${{ secrets.GITHUB_TOKEN }}",
+						},
+						"run": "gh issue list",
+					},
+				},
+			},
+			strictMode:  true,
+			expectError: false,
+		},
 		{
 			name: "post-steps without secrets is allowed",
 			frontmatter: map[string]any{
@@ -89,7 +105,7 @@ func TestValidateStepsSecrets(t *testing.T) {
 					map[string]any{
 						"uses": "some/action@v1",
 						"with": map[string]any{
-							"token": "${{ secrets.GITHUB_TOKEN }}",
+							"token": "${{ secrets.MY_API_TOKEN }}",
 						},
 					},
 				},
