Allow explicit wildcard GitHub App repositories in strict mode

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
pelikhan · Oct 6, 2026 · Oct 6, 2026 · Oct 6, 2026 · Oct 6, 2026 · Oct 6, 2026
commit 3803aa59b6665f30a7ae5753f24086e2d82598c3
diff --git a/pkg/workflow/app_token_permissions_validation.go b/pkg/workflow/app_token_permissions_validation.go
@@ -8,6 +8,27 @@ import (
 	"github.com/github/gh-aw/pkg/console"
 )
 
+type appTokenStepKey struct {
+	id, clientID, privateKey string
+}
+
+func (c *Compiler) hasGeneratedWildcardAppTokenStep(step, with map[string]any) bool {
+	id, ok := step["id"].(string)
+	if !ok {
+		return false
+	}
+	clientID, ok := with["client-id"].(string)
+	if !ok {
+		return false
+	}
+	privateKey, ok := with["private-key"].(string)
+	if !ok {
+		return false
+	}
+	return id != "" && clientID != "" && privateKey != "" &&
+		c.wildcardAppTokenSteps[appTokenStepKey{id, clientID, privateKey}]
+}
+
 func hasExplicitAppTokenPermission(with map[string]any) bool {
 	for key, value := range with {
 		if !strings.HasPrefix(strings.ToLower(key), "permission-") {
@@ -68,7 +89,7 @@ func (c *Compiler) validateAppTokenPermissions(workflow map[string]any, strict b
 			if !ok {
 				with = nil
 			}
-			if !hasExplicitAppTokenRepositories(with) {
+			if !hasExplicitAppTokenRepositories(with) && !c.hasGeneratedWildcardAppTokenStep(step, with) {
 				msg := fmt.Sprintf("actions/create-github-app-token in job %q has no explicit repositories input; add repositories: ${{ github.repository }} to scope the token to the current repository", jobName)
 				if strict {
 					return fmt.Errorf("strict mode: %s", msg)

diff --git a/pkg/workflow/app_token_permissions_validation_test.go b/pkg/workflow/app_token_permissions_validation_test.go
@@ -83,6 +83,83 @@ func TestAppTokenPermissionsCheckAllCompiledJobs(t *testing.T) {
 	}
 }
 
+func TestAppTokenPermissionsGeneratedWildcardRepositories(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		config string
+		stepID string
+	}{
+		{
+			name:   "github tool",
+			config: "tools:\n  github:\n    toolsets: [repos]\n    github-app:\n      app-id: ${{ vars.APP_ID }}\n      private-key: ${{ secrets.APP_KEY }}\n      repositories: [\"*\"]\n",
+			stepID: "github-mcp-app-token",
+		},
+		{
+			name:   "safe outputs",
+			config: "safe-outputs:\n  github-app:\n    app-id: ${{ vars.APP_ID }}\n    private-key: ${{ secrets.APP_KEY }}\n    repositories: [\"*\"]\n  create-issue:\n",
+			stepID: "safe-outputs-app-token",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			dir := t.TempDir()
+			path := filepath.Join(dir, "wildcard.md")
+			content := "---\non: workflow_dispatch\nstrict: true\nengine: copilot\npermissions:\n  contents: read\nnetwork:\n  allowed: [defaults]\n" +
+				tc.config + "---\n\nTest wildcard token.\n"
+			if err := os.WriteFile(path, []byte(content), 0o600); err != nil {
+				t.Fatal(err)
+			}
+			compiler := NewCompiler()
+			compiler.approve = true
+			if err := compiler.CompileWorkflow(path); err != nil {
+				t.Fatalf("explicit wildcard should compile in strict mode: %v", err)
+			}
+			if compiler.warningCount != 0 {
+				t.Fatalf("explicit wildcard should not produce scope warnings, got %d", compiler.warningCount)
+			}
+			lock, err := os.ReadFile(filepath.Join(dir, "wildcard.lock.yml"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			step := strings.SplitN(string(lock), "id: "+tc.stepID, 2)
+			if len(step) != 2 {
+				t.Fatalf("missing generated token step %s", tc.stepID)
+			}
+			tokenInputs := strings.SplitN(step[1], "\n      - name:", 2)[0]
+			if strings.Contains(tokenInputs, "repositories:") || !strings.Contains(tokenInputs, "permission-") {
+				t.Fatalf("wildcard token must omit repositories and retain explicit permissions:\n%s", tokenInputs)
+			}
+		})
+	}
+}
+
+func TestAppTokenPermissionsWildcardStillChecksPermissionsAndOtherSteps(t *testing.T) {
+	compiler := NewCompiler()
+	compiler.buildGitHubAppTokenMintStepWithMeta(
+		&GitHubAppConfig{AppID: "app-id", PrivateKey: "private-key", Repositories: []string{"*"}},
+		nil, "", "", "Mint token", "generated-token",
+	)
+	generated := map[string]any{
+		"id": "generated-token", "uses": "actions/create-github-app-token@sha",
+		"with": map[string]any{"client-id": "app-id", "private-key": "private-key"},
+	}
+	workflow := map[string]any{"jobs": map[string]any{"agent": map[string]any{"steps": []any{generated}}}}
+	if err := compiler.validateAppTokenPermissions(workflow, true); err == nil || !strings.Contains(err.Error(), "permission-*") {
+		t.Fatalf("wildcard must not bypass permission checks, got %v", err)
+	}
+	generated["with"].(map[string]any)["permission-contents"] = "read"
+	if err := compiler.validateAppTokenPermissions(workflow, true); err != nil {
+		t.Fatalf("generated wildcard should pass with explicit permissions: %v", err)
+	}
+	workflow["jobs"].(map[string]any)["custom"] = map[string]any{"steps": []any{
+		map[string]any{"uses": "actions/create-github-app-token@sha", "with": map[string]any{
+			"client-id": "other-app", "private-key": "private-key", "permission-contents": "read",
+		}},
+	}}
+	if err := compiler.validateAppTokenPermissions(workflow, true); err == nil || !strings.Contains(err.Error(), "repositories input") {
+		t.Fatalf("other steps must still require repository scoping, got %v", err)
+	}
+}
+
 func TestAppTokenPermissionsGeneratedPreActivationStep(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "app-token.md")

diff --git a/pkg/workflow/compiler.go b/pkg/workflow/compiler.go
@@ -494,6 +494,7 @@ func (c *Compiler) CompileWorkflowData(workflowData *WorkflowData, markdownPath
 
 	// Reset the step order tracker for this compilation
 	c.stepOrderTracker = NewStepOrderTracker()
+	c.wildcardAppTokenSteps = nil
 
 	// Reset schedule friendly formats for this compilation
 	c.scheduleFriendlyFormats = nil

diff --git a/pkg/workflow/compiler_types.go b/pkg/workflow/compiler_types.go
@@ -76,6 +76,7 @@ type Compiler struct {
 	featureUsage            map[string]int           // Counts experimental feature usage across workflows in batch mode
 	permissionWarningShown  map[string]string        // Tracks markdown paths and last warning fingerprint (frontmatter hash when available, otherwise formatted warning text)
 	allowedDomainsCache     map[string]allowedDomain // Cached allowed-domains per markdown path with the frontmatter hash that produced it
+	wildcardAppTokenSteps   map[appTokenStepKey]bool // Compiler-generated token steps with an explicit repositories: ["*"] configuration
 	// modelPricingResolver is an optional callback for resolving per-token pricing of models that
 	// are absent from the embedded models.json catalog. When non-nil it is called during
 	// buildInitialWorkflowData for the workflow's configured model; any returned pricing is merged

diff --git a/pkg/workflow/safe_outputs_app_config.go b/pkg/workflow/safe_outputs_app_config.go
@@ -426,6 +426,16 @@ func appendGitHubAppTokenRepositoryInput(steps []string, app *GitHubAppConfig, f
 
 func (c *Compiler) buildGitHubAppTokenMintStepWithMeta(app *GitHubAppConfig, permissions *Permissions, fallbackRepoExpr string, ownerSourceRepository string, stepName string, stepID string) []string {
 	safeOutputsAppLog.Printf("Building GitHub App token mint step: owner=%s, repos=%d", app.Owner, len(app.Repositories))
+	if len(app.Repositories) == 1 {
+		for _, repository := range app.Repositories {
+			if repository == "*" {
+				if c.wildcardAppTokenSteps == nil {
+					c.wildcardAppTokenSteps = make(map[appTokenStepKey]bool)
+				}
+				c.wildcardAppTokenSteps[appTokenStepKey{stepID, app.AppID, app.PrivateKey}] = true
+			}
+		}
+	}
 	var steps []string
 
 	owner, ownerSteps := resolveGitHubAppOwner(app, ownerSourceRepository, stepName, stepID)