🔑 Rename safe-output-projects to safe-output-custom-tokens

[dsyme]

Summary

• Renamed the safe-output-projects setup input to safe-output-custom-tokens, broadening its scope to cover any per-handler github-token (not just project handlers)
• Updated hasProjectRelatedSafeOutputs to hasCustomTokenSafeOutputs, which now checks all safe output types for a custom token before enabling @actions/github installation
• Renamed all internal variables from authClient to githubClient across handler .cjs files for clarity

[Copilot]

Pull request overview

Renames the setup action input safe-output-projects to safe-output-custom-tokens and updates the compiler/runtime logic so @actions/github is installed only when needed for per-handler token (github-token) Octokit creation.

Changes:

• Renamed setup input and wiring from safe-output-projects → safe-output-custom-tokens (action.yml, setup.sh, workflow generation).
• Replaced hasProjectRelatedSafeOutputs with hasCustomTokenSafeOutputs to decide when to enable runtime installation of @actions/github.
• Renamed handler-local variable authClient → githubClient across safe-output handler .cjs files.

Reviewed changes

Copilot reviewed 37 out of 37 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pkg/workflow/compiler_yaml_helpers.go	Updates generated setup-step YAML to use the new safe-output-custom-tokens input/env var.
pkg/workflow/compiler_safe_outputs_job.go	Switches setup-step enabling logic to hasCustomTokenSafeOutputs.
pkg/workflow/compiler_safe_outputs_core.go	Implements hasCustomTokenSafeOutputs and helper to scan safe output configs for per-handler tokens.
pkg/workflow/cjs_require_validation_test.go	Adds an exception entry intended to allow @actions/github usage for handler_auth.cjs.
actions/setup/setup.sh	Renames the flag/env var and installs @actions/github when custom tokens are enabled.
actions/setup/js/update_release.cjs	Renames authClient → githubClient.
actions/setup/js/update_handler_factory.cjs	Renames authClient → githubClient and updates comments/calls.
actions/setup/js/unassign_from_user.cjs	Renames authClient → githubClient.
actions/setup/js/submit_pr_review.cjs	Renames authClient → githubClient.
actions/setup/js/set_issue_type.cjs	Renames authClient → githubClient, including JSDoc param names and call sites.
actions/setup/js/resolve_pr_review_thread.cjs	Renames authClient → githubClient.
actions/setup/js/reply_to_pr_review_comment.cjs	Renames authClient → githubClient.
actions/setup/js/remove_labels.cjs	Renames authClient → githubClient.
actions/setup/js/push_to_pull_request_branch.cjs	Renames authClient → githubClient.
actions/setup/js/mark_pull_request_as_ready_for_review.cjs	Renames authClient → githubClient.
actions/setup/js/link_sub_issue.cjs	Renames authClient → githubClient.
actions/setup/js/hide_comment.cjs	Renames authClient → githubClient.
actions/setup/js/handler_auth.cjs	Updates usage examples to githubClient and relies on @actions/github via dynamic import when needed.
actions/setup/js/dispatch_workflow.cjs	Renames authClient → githubClient.
actions/setup/js/create_pull_request.cjs	Renames authClient → githubClient.
actions/setup/js/create_pr_review_comment.cjs	Renames authClient → githubClient.
actions/setup/js/create_issue.cjs	Renames authClient → githubClient (including argument object key usage).
actions/setup/js/create_discussion.cjs	Renames authClient → githubClient.
actions/setup/js/close_pull_request.cjs	Renames authClient → githubClient.
actions/setup/js/close_issue.cjs	Renames authClient → githubClient.
actions/setup/js/close_discussion.cjs	Renames authClient → githubClient.
actions/setup/js/assign_to_user.cjs	Renames authClient → githubClient.
actions/setup/js/assign_milestone.cjs	Renames authClient → githubClient.
actions/setup/js/add_reviewer.cjs	Renames authClient → githubClient.
actions/setup/js/add_labels.cjs	Renames authClient → githubClient.
actions/setup/js/add_comment.cjs	Renames authClient → githubClient.
actions/setup/action.yml	Renames composite action input/env wiring to safe-output-custom-tokens.
.github/workflows/test-project-url-default.lock.yml	Removes old safe-output-projects input from the locked workflow.
.github/workflows/smoke-update-cross-repo-pr.lock.yml	Adds safe-output-custom-tokens: 'true' to the locked workflow.
.github/workflows/smoke-project.lock.yml	Replaces safe-output-projects with safe-output-custom-tokens.
.github/workflows/smoke-create-cross-repo-pr.lock.yml	Adds safe-output-custom-tokens: 'true' to the locked workflow.
.github/workflows/security-alert-burndown.campaign.g.lock.yml	Removes old safe-output-projects input from the locked workflow.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Smoke Test: Copilot - Cross-repo create PR 22559015980 — IN PROGRESS

• Create smoke test file on branch ✅
• Create PR in side repo ⏳

Run: https://github.com/github/gh-aw/actions/runs/22559015980

🔬 Cross-repo smoke test by Smoke Create Cross-Repo PR

[albokynk]

DORA_oversight_-_Joint_ESAs_targeted_equivalence_assessments.pdf