Fix checkout frontmatter: rename checkout.github-token to checkout.token for actions/checkout

[Copilot]

actions/checkout expects the input named token, not github-token. This PR renames the frontmatter field checkout.github-token → checkout.token to align the user-facing name with the action's actual input, eliminating any confusion between the two.

Changes

• CheckoutConfig struct (checkout_manager.go): Renamed field GitHubToken → Token with JSON tag "token,omitempty". Updated the add() merging logic and the ParseSingleCheckoutConfig parser to use m["token"]. Removed now-unnecessary comments explaining the github-token → token mapping.

• Schema (pkg/parser/schemas/main_workflow_schema.json): Renamed the "github-token" property to "token" in the checkoutConfig definition.

• Regression test (checkout_manager_test.go): Added subtest additional checkout emits token not github-token in TestGenerateAdditionalCheckoutSteps asserting that generateCheckoutStepLines emits token: and never github-token:. Updated all CheckoutConfig field references from GitHubToken: to Token: and map key "github-token" to "token" in parse tests.

• Test cleanup (trial_mode_test.go): Improved comments to clarify that the test checks for absence of an implicit/default token when the workflow doesn't configure one.

• Docs (reference/frontmatter.md, reference/cross-repository.md): Updated all checkout examples to use token: instead of github-token:. Non-checkout contexts (tools.github, safe-outputs) are unchanged.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Fix checkout frontmatter: emit token (not github-token) for actions/checkout</issue_title>
<issue_description>## Fix checkout frontmatter: emit token (not github-token) for actions/checkout

Bug summary

When checkout frontmatter includes a custom github-token, the compiler emits an actions/checkout step with a github-token input. The actions/checkout action expects the input name token, so custom tokens do not work and checkout can fail or use the wrong credentials.

Analysis

Root cause: In pkg/workflow/checkout_manager.go, the YAML for the actions/checkout step is built with the literal key github-token in two places:

• Line 234 in GenerateDefaultCheckoutStep: when applying user overrides (non–trial mode), it emits fmt.Fprintf(&sb, " github-token: %s\n", override.token).
• Line 277 in generateCheckoutStepLines: for additional checkout steps it emits fmt.Fprintf(&sb, " github-token: %s\n", entry.token).

The actions/checkout action only accepts the input token. The same file already uses token correctly for trial mode at line 222: fmt.Fprintf(&sb, " token: %s\n", effectiveToken). The fix is to emit token (not github-token) wherever the token is passed to actions/checkout. The frontmatter key can remain github-token (user-facing); only the emitted YAML key for the action input must be token.

Implementation plan

Please implement the following so an agent can execute it step by step.

1. Fix YAML emission in pkg/workflow/checkout_manager.go

• In GenerateDefaultCheckoutStep (around line 233–235): when override.token != "", emit the input as token, not github-token.
  Change:
  fmt.Fprintf(&sb, " github-token: %s\n", override.token)
  to:
  fmt.Fprintf(&sb, " token: %s\n", override.token).

• In generateCheckoutStepLines (around line 276–278): when entry.token != "", emit the input as token, not github-token.
  Change:
  fmt.Fprintf(&sb, " github-token: %s\n", entry.token)
  to:
  fmt.Fprintf(&sb, " token: %s\n", entry.token).

No other changes in this file are required: struct fields and parsing can keep the name GitHubToken / github-token for frontmatter/schema; only the generated action input name must be token.

2. Update tests that assert on github-token in checkout steps

• pkg/workflow/checkout_manager_test.go

  • Replace assertions that expect github-token: in the generated checkout step YAML with expectations of token: (same value, different key).
  • Example (around line 127): change the expected string from "github-token: ${{ secrets.MY_TOKEN }}" to "token: ${{ secrets.MY_TOKEN }}" (and similar cases in that file).

• pkg/workflow/checkout_optimization_test.go

  • It already expects token: ${{ secrets.CUSTOM_TOKEN }} (line 94). Ensure no remaining expectations use github-token for the checkout step; if any do, update them to token.

• pkg/workflow/trial_mode_test.go

  • Tests that look for “github-token in checkout step” (e.g. around lines 77–88, 136–208, 321–324) should be updated to look for token in the checkout step’s with: block (since the correct input name is token). Adjust comments and assertions accordingly.

• pkg/workflow/pr_checkout_test.go

  • Around lines 406–408 the test expects github-token in the “Checkout PR branch” step. That step uses actions/github-script, not actions/checkout. The actions/github-script action uses the input github-token. So leave this test unchanged; only the actions/checkout steps should use token.

3. Optional: add a regression test

• In pkg/workflow/checkout_manager_test.go (or a dedicated test), add a case that:
  • Builds a checkout config with a custom token (e.g. GitHubToken: "${{ secrets.MY_TOKEN }}").
  • Calls GenerateDefaultCheckoutStep or the helper that produces the additional checkout steps.
  • Asserts that the generated YAML contains token: ${{ secrets.MY_TOKEN }} and does not contain github-token: in the same step (to avoid regressing to the wrong input name).

4. Documentation

• In pkg/workflow/checkout_manager.go, the comment around lines 19–21 shows an example with github-token: in the YAML. Update that example so it shows the emitted format: use token: in the example of the generated step (or add a short note that the frontmatter key github-token is emitted as the token input for actions/checkout).
• If docs/ or pkg/parser/schemas document the checkout step output format, ensure they state that the compiler emits token fo...

Custom agent used: technical-doc-writer
AI technical documentation writer for GitHub Actions library using GitHub Docs voice

• Fixes Fix checkout frontmatter: emit token (not github-token) for actions/checkout #18825

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

---

---

✨ PR Review Safe Output Test - Run 22526334288

💥 [THE END] — Illustrated by Smoke Claude

[Copilot]

Pull request overview

Aligns checkout token naming so that checkout.github-token frontmatter compiles to the correct actions/checkout input (token), and prevents regressions via tests/docs updates.

Changes:

• Added a regression subtest ensuring additional checkout steps emit token: and never github-token:.
• Updated trial mode test diagnostics/comments to reference token (matching current compiled output).
• Documented the frontmatter key vs compiled action input name mapping in the frontmatter reference docs.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
pkg/workflow/trial_mode_test.go	Updates comments/error strings to match token naming in compiled checkout steps.
pkg/workflow/checkout_manager_test.go	Adds regression test to ensure additional checkouts emit token (not github-token).
docs/src/content/docs/reference/frontmatter.md	Adds a NOTE clarifying github-token (frontmatter) → token (compiled actions/checkout input).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[pelikhan]

@copilot align field name to actions/checkout since we will be fighting the model habits on this. Rename "checkout.github-token" to "checkout.token"

[Copilot]

@copilot align field name to actions/checkout since we will be fighting the model habits on this. Rename "checkout.github-token" to "checkout.token"

Done in 2ff9304. Renamed checkout.github-token → checkout.token throughout: CheckoutConfig.Token field with json:"token" tag, parser updated to read m["token"], schema checkoutConfig property renamed, all tests and docs updated. The field name now matches actions/checkout's input directly.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/actions/checkout/git/ref/tags/v5
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE go ache�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE erignore (http block)
• telemetry.astro.build
  • Triggering command: /opt/hostedtoolcache/node/24.13.1/x64/bin/node node /home/REDACTED/work/gh-aw/gh-aw/docs/node_modules/.bin/astro build /opt/hostedtoolc-tests -o -o public/slides/index.html -trimpath 64/bin/go s/gh-aw-theme.css -o public/slides/index.html main -lang=go1.25 go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[pelikhan]

@copilot make sure the JSON schema type checkout does not allow additional protperties + fix any agentic workflow using checkout to the new syntax

[Copilot]

@copilot make sure the JSON schema type checkout does not allow additional protperties + fix any agentic workflow using checkout to the new syntax

Both items are already handled by the previous commit (2ff9304):

1. additionalProperties: false — the checkoutConfig JSON schema definition already includes "additionalProperties": false.

2. Agentic workflows — only one workflow file (smoke-codex.md) uses a checkout: section, and it uses fetch-depth/current (not github-token). All other github-token references in the workflow .md files are in actions/github-script steps, tools.github:, and safe-outputs: sections — those correctly keep github-token and don't need changes.

[pelikhan]

@copilot fix tests https://github.com/github/gh-aw/actions/runs/22526463297/job/65259156794