[gh-aw] Eliminate magic GH_AW_* secret references from lock files

.github/aw/actions-lock.json

@@ -25,10 +25,15 @@
       "version": "v7.0.1",
       "sha": "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
     },
-    "github/gh-aw-actions/setup@v0.77.5": {
+    "github/gh-aw-actions/setup-cli@v0.79.8": {
+      "repo": "github/gh-aw-actions/setup-cli",
+      "version": "v0.79.8",
+      "sha": "c0338fef4749d08c21f8f975fb0e37efa17dda47"
+    },
+    "github/gh-aw-actions/setup@v0.79.8": {
       "repo": "github/gh-aw-actions/setup",
-      "version": "v0.77.5",
-      "sha": "3ea13c02d765410340d533515cb31a7eef2baaf0"
+      "version": "v0.79.8",
+      "sha": "c0338fef4749d08c21f8f975fb0e37efa17dda47"
     }
   },
   "containers": {

.github/dependabot.yml

@@ -3,7 +3,8 @@ updates:
     default-days: 7
   directory: /
   ignore:
-  - dependency-name: "github/gh-aw-actions/**" # Managed by gh aw compile. Version-locked to the gh-aw compiler; do not bump.
+  - dependency-name: "github/gh-aw-actions/**"
+  - dependency-name: "github/gh-aw-actions" # Managed by gh aw compile. Version-locked to the gh-aw compiler; do not bump.
   package-ecosystem: github-actions
   schedule:
     interval: weekly

.github/workflows/ci-postmortem.md

@@ -19,9 +19,11 @@ network:
     - "vsassets.io"
 tools:
   github:
+    github-token: ${{ secrets.GITHUB_TOKEN }}
     toolsets: [issues, repos]
     min-integrity: none
 safe-outputs:
+  github-token: ${{ secrets.GITHUB_TOKEN }}
   create-issue:
     max: 20
   add-comment:

.github/workflows/code-radiator.md

@@ -18,13 +18,16 @@ network:
     - github
 tools:
   github:
+    github-token: ${{ secrets.GITHUB_TOKEN }}
     toolsets: [pull_requests, repos]
     min-integrity: approved
   bash: true
 checkout:
+  github-token: ${{ secrets.GITHUB_TOKEN }}
   fetch: ["*"]
   fetch-depth: 0
 safe-outputs:
+  github-token: ${{ secrets.GITHUB_TOKEN }}
   max-patch-files: 1000
   max-patch-size: 10240
   create-pull-request:

.github/workflows/macios-reviewer.md

@@ -24,9 +24,11 @@ network:
     - "vsassets.io"
 tools:
   github:
+    github-token: ${{ secrets.GITHUB_TOKEN }}
     toolsets: [pull_requests, repos]
     min-integrity: approved
 safe-outputs:
+  github-token: ${{ secrets.GITHUB_TOKEN }}
   create-pull-request-review-comment:
     max: 50
   submit-pull-request-review:

.github/workflows/zizmor.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Find workflow files
         id: find-files
         run: |
-          files=$(find .github/workflows -name '*.yml' ! -name '*.lock.yml' | sort | tr '\n' ' ')
+          files=$(find .github/workflows -name '*.yml' ! -name '*.lock.yml' ! -name 'agentics-maintenance.yml' | sort | tr '\n' ' ')
           echo "files=$files" >> "$GITHUB_OUTPUT"
 
       - name: Run zizmor