[workshop-sync] workshop/side-quest-16-05-long-lived-credentials.md: step-level PAT injection conflicts with strict mode
Maintainers usually reply within 3 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 76/100
- Issue type
- Documentation
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- github-actions, javascript
- Domain
- documentation
Research direction
Edit workshop/side-quest-16-05-long-lived-credentials.md, focusing on both recommendations for step-level PAT injection. Start by checking the steps: “Secrets restriction” section in the gh-aw v1.0.1 syntax reference cited by the issue. Update the guidance to recommend a separate job or declarative secret mechanisms such as github-app: or engine/tool token configuration, then confirm neither mention recommends injecting a non-GITHUB_TOKEN secret into custom steps.
Written by the indexing model from the issue text.
Description
Workshop file reviewed
workshop/side-quest-16-05-long-lived-credentials.md
Problem
The guide recommends step-level PAT injection:
| Inject the PAT at the step level, not globally | Keeps it out of other steps' environments, including the AI prompt step |
and repeats it later: "Inject PATs at the step level with env:".
In gh-aw, using ${{ secrets.* }} other than secrets.GITHUB_TOKEN in custom steps: entries is an error in strict mode (the default) and a warning otherwise. The guide doesn't mention this.
Current correct behaviour
See the steps: "Secrets restriction" section in the gh-aw syntax reference (gh-aw v1.0.1).
Suggested fix
Replace both mentions with guidance to put secret-dependent operations in a separate job outside the agent job, or use declarative mechanisms such as github-app: or the engine/tool token configuration. Don't recommend injecting a non-GITHUB_TOKEN secret into custom steps: under strict mode.
Generated by 🔍 Workshop Sync Check · copilot · auto · ~53 AIC · ⌖ ~1 AIC · ⊞ 4.7K · ◷
- expires on Nov 7, 2026, 9:03 PM UTC
- Dominant language
- JavaScript
- Stars
- 58
- Forks
- 40
- Avg merge
- 4d 4h
- Merged PRs (30d)
- 8
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- No Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from githubnext/gh-aw-workshop
-
curriculum documentation quality
Difficulty 2/5 1-3 hours Newbie friendliness 77/100
githubnext/gh-aw-workshop#5437 ·
Maintainers usually reply within 3 days
-
curriculum documentation quality
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
githubnext/gh-aw-workshop#5436 ·
Maintainers usually reply within 3 days
-
curriculum documentation quality
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
githubnext/gh-aw-workshop#5434 ·
Maintainers usually reply within 3 days
-
curriculum documentation quality
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
githubnext/gh-aw-workshop#5433 ·
Maintainers usually reply within 3 days
-
documentation
Difficulty 1/5 Under an hour Newbie friendliness 85/100
githubnext/gh-aw-workshop#5421 ·
Maintainers usually reply within 3 days
All issues in githubnext/gh-aw-workshop
Similar issues
-
stringify escapes leading digits in pseudo-class arguments (:nth-child(1) becomes :nth-child(\31 ))Open
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
digitalbazaar/forge#1170 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
getgrav/grav-plugin-form#664 ·
-
bug web-ui
Difficulty 2/5 1-3 hours Newbie friendliness 67/100
jenkinsci/jenkins#27705 · 3 comments ·
Maintainers usually reply within 1 day