Remove legacy token GH_AW_COPILOT_TOKEN

[Copilot]

Removes all support for the GH_AW_COPILOT_TOKEN secret name. Users must migrate to COPILOT_GITHUB_TOKEN (recommended) or GH_AW_GITHUB_TOKEN (legacy).

Changes

Token fallback chain updated:

• Before: COPILOT_GITHUB_TOKEN → GH_AW_COPILOT_TOKEN → GH_AW_GITHUB_TOKEN
• After: COPILOT_GITHUB_TOKEN → GH_AW_GITHUB_TOKEN

Code:

• pkg/workflow/github_token.go - Removed from getEffectiveCopilotGitHubToken()
• pkg/workflow/safe_outputs.go - Removed from inline script fallback
• pkg/workflow/js/create_agent_task.cjs - Updated error message
• pkg/workflow/github_token_test.go - Updated test expectations

Documentation:

• docs/reference/tokens.md - Updated precedence lists and migration guide
• docs/reference/safe-outputs.md - Updated safe output token requirements
• docs/reference/engines.md - Updated legacy token notices
• skills/gh-agent-task/SKILL.md - Updated token precedence

Specs:

• specs/template-injection-prevention.md - Updated example
• specs/security_review.md - Updated example

Migration

gh secret remove GH_AW_COPILOT_TOKEN -a actions
gh secret set COPILOT_GITHUB_TOKEN -a actions --body "YOUR_PAT"

Context

Follows the pattern established when COPILOT_CLI_TOKEN was removed in v0.26+. All 106 workflow lock files regenerated with updated token chain.

Original prompt

Remove legacy token GH_AW_COPILOT_TOKEN

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

---

Changeset

• Type: minor
• Description: Remove legacy support for GH_AW_COPILOT_TOKEN. The token precedence now is COPILOT_GITHUB_TOKEN → GH_AW_GITHUB_TOKEN. See .changeset/minor-remove-legacy-gh-aw-copilot-token.md for migration steps.

Ahoy! This treasure was crafted by 🏴‍☠️ Changeset Generator

[github-actions]

📰 BREAKING: Smoke Copilot Playwright is now investigating this pull request. Sources say the story is developing...

[github-actions]

💥 WHOOSH! Smoke Claude springs into action on this pull request! [Panel 1 begins...]

[github-actions]

🔮 The ancient spirits stir... Smoke Codex awakens to divine this pull request...

[github-actions]

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

9c69156

[github-actions]

📰🚀🔍👀📡🕵️ https://github.com/githubnext/gh-aw/actions/runs/20107380581

[github-actions]

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

[github-actions]

Copilot Smoke Test Results

PR Titles (last 2 merged):

• Fix linting errors and update action pin SHA #6044: Fix linting errors and update action pin SHA
• Sort safe output tool names for deterministic compilation #6037: Sort safe output tool names for deterministic compilation

Test Results:

• ✅ GitHub MCP - Retrieved PRs successfully
• ✅ File Writing - Created /tmp/gh-aw/agent/smoke-test-copilot-20107380573.txt
• ✅ Bash Tool - Verified file with cat
• ✅ Default Toolset - get_me correctly unavailable (403 error expected)
• ✅ Cache Memory - Created /tmp/gh-aw/cache-memory/smoke-test-20107380573.txt

Overall Status: PASS

📰 BREAKING: Report filed by Smoke Copilot fer issue #6045 🗺️

[github-actions]

Smoke Test Results

Recent PRs:

• Fix linting errors and update action pin SHA #6044: Fix linting errors and update action pin SHA
• Sort safe output tool names for deterministic compilation #6037: Sort safe output tool names for deterministic compilation

Test Results:

• ✅ GitHub MCP (list PRs)
• ✅ File Writing (/tmp/gh-aw/agent/)
• ✅ Bash Tool (cat verification)
• ✅ Playwright (GitHub page title verified)
• ✅ Cache Memory (/tmp/gh-aw/cache-memory/)
• ❌ Safe Input gh Tool (not tested - tool not available)

Overall: PASS (5/6 tests successful)

💥 [THE END] — Illustrated by Smoke Claude fer issue #6045 🗺️

[github-actions]

Smoke Test Results (Run 20107380584)

✅ Playwright MCP: Successfully navigated to https://github.com - Page title: "GitHub · Change is constant. GitHub keeps you ahead. · GitHub"
✅ Cache Memory: Created test file /tmp/gh-aw/cache-memory/smoke-test-20107380584.txt with expected content
❌ Safe Input gh Tool: Failed with HTTPS client error

Overall Status: PARTIAL PASS - 2/3 tests passed. Safe input gh tool issue is infrastructure-related (HTTP/HTTPS protocol mismatch).

📰 BREAKING: Report filed by Smoke Copilot Playwright fer issue #6045 🗺️

[github-actions]

Smoke Test Results

GitHub MCP: ❌ (HTTP/HTTPS protocol error)
File Writing: ✅ (Created and verified)
Bash Tool: ✅ (File operations successful)
Serena MCP: ❌ (Not tested - tool unavailable)
safeinputs-gh Tool: ❌ (API connection issues)

Overall Status: FAIL

📰🔥📋 https://github.com/githubnext/gh-aw/actions/runs/20107380581 fer issue #6045 🗺️

[github-actions]

Last merged PRs: Fix linting errors and update action pin SHA; Sort safe output tool names for deterministic compilation
GitHub MCP test: ✅
File write/read (/tmp/gh-aw/agent): ✅
Playwright title contains "GitHub": ✅
Cache memory file: ✅
safeinputs-gh (gh issues list): ❌ tool unavailable
Overall: FAIL

🔮 The oracle has spoken through Smoke Codex fer issue #6045 🗺️