[gh-aw] Eliminate magic GH_AW_* secret references from lock files

[rolfbjarne]

The dotnet/macios secret-audit report flags every secret name that appears in a compiled agentic workflow, including the "magic" fallback secrets that gh-aw emits as the tail of its token-resolution chains (GH_AW_GITHUB_TOKEN and GH_AW_GITHUB_MCP_SERVER_TOKEN). Those names showed up in all three *.lock.yml files even though we never configure them, because gh-aw bakes the full fallback expression into every safe-output handler, into the GitHub MCP server wiring, and into the checkout "Fetch additional refs" step.

Set explicit github-token: ${{ secrets.GITHUB_TOKEN }} overrides so the compiler short-circuits each fallback chain before it references the magic names:

• tools.github.github-token → replaces the GH_AW_GITHUB_MCP_SERVER_TOKEN → GH_AW_GITHUB_TOKEN → GITHUB_TOKEN chain used by the GitHub MCP server container.
• safe-outputs.github-token → replaces the GH_AW_GITHUB_TOKEN → GITHUB_TOKEN chain used by the safe-output handlers.
• checkout.github-token (code-radiator only) → replaces the GH_AW_GITHUB_MCP_SERVER_TOKEN → GH_AW_GITHUB_TOKEN → GITHUB_TOKEN chain used by the "Fetch additional refs" step that checkout.fetch: ["*"] generates. GITHUB_TOKEN is sufficient to fetch refs from the same repository, so there is no functional change.

GH_AW_CI_TRIGGER_TOKEN is intentionally left in place in code-radiator. Unlike the chains above it is not a magic fallback: it is the documented secret gh-aw uses to push an empty commit after create-pull-request / push-to-pull-request-branch so that CI runs on the auto-created merge PRs (pushes made with GITHUB_TOKEN do not trigger workflow runs — a GitHub Actions security feature). Overriding it with GITHUB_TOKEN would silently stop CI from triggering on those PRs.

This branch also recompiles all three workflows with the locally installed gh-aw compiler (v0.79.8), which refreshes the generated lock files, the agentics-maintenance.yml maintenance workflow, actions-lock.json, and the gh-aw dependabot ignore entry.

After recompiling, the # Secrets used: block in each lock file lists only secrets that are actually configured:

Workflow	Secrets
ci-postmortem.lock.yml	COPILOT_GITHUB_TOKEN, GITHUB_TOKEN
code-radiator.lock.yml	COPILOT_GITHUB_TOKEN, GH_AW_CI_TRIGGER_TOKEN, GITHUB_TOKEN
macios-reviewer.lock.yml	COPILOT_GITHUB_TOKEN, GITHUB_TOKEN

gh aw compile reports 0 errors on all three workflows.

Inspired by dotnet/android#11685 (commit dbd72dd).

🤖 Pull request created by Copilot

[Copilot]

Pull request overview

This PR updates the repository’s gh-aw (GitHub Agentic Workflows) configurations to prevent “magic” GH_AW_* secret names from being embedded in compiled *.lock.yml workflows by explicitly setting github-token: ${{ secrets.GITHUB_TOKEN }} in workflow frontmatter, and then recompiling the lock files with a newer gh-aw compiler.

Changes:

• Add explicit github-token overrides in the gh-aw frontmatter for tools.github, safe-outputs, and checkout (where used) to short-circuit gh-aw’s token fallback chains.
• Recompile the affected workflows’ *.lock.yml outputs (and refresh generated maintenance/lock artifacts) using gh-aw v0.79.8.
• Update Dependabot ignore configuration for gh-aw-actions entries.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/macios-reviewer.md	Adds explicit github-token overrides for GitHub tool + safe-outputs.
.github/workflows/macios-reviewer.lock.yml	Recompiled lock workflow; removes GH_AW_* secret fallback references and updates generated content to gh-aw v0.79.8.
.github/workflows/code-radiator.md	Adds explicit github-token overrides for GitHub tool + checkout + safe-outputs.
.github/workflows/code-radiator.lock.yml	Recompiled lock workflow; removes GH_AW_* secret fallback references and updates generated content to gh-aw v0.79.8.
.github/workflows/ci-postmortem.md	Adds explicit github-token overrides for GitHub tool + safe-outputs.
.github/workflows/ci-postmortem.lock.yml	Recompiled lock workflow; removes GH_AW_* secret fallback references and updates generated content to gh-aw v0.79.8.
.github/workflows/agentics-maintenance.yml	Adds the generated gh-aw maintenance workflow (v0.79.8).
.github/dependabot.yml	Adjusts ignore entries for gh-aw-actions dependencies.
.github/aw/actions-lock.json	Updates gh-aw-actions entries (but see review comment about remaining drift).