Wire up `github-token-for-extra-empty-commit`

[strawgate]

create-pull-request and push-to-pull-request-branch both support github-token-for-extra-empty-commit which pushes an extra commit to reset the affiliation with the github-actions[bot] and allow workflows to run.

Let's expose this as an input that callers can configure if needed.

[github-actions]

TL;DR: this is a valid gap — GH_AW_CI_TRIGGER_TOKEN is injected internally today, but github-token-for-extra-empty-commit is not exposed as a caller-configurable workflow input anywhere, so we should add it to the create-PR/push-to-PR workflow surfaces.

Recommendation

Add an optional reusable-workflow input named github-token-for-extra-empty-commit (default "") to all gh-aw-*.md workflows that import safe-output-create-pr.md or safe-output-push-to-pr.md, then wire that input into both safe-output fragments so callers can opt in per trigger workflow.

Findings

• Issue request is explicit: expose github-token-for-extra-empty-commit so callers can configure it (Wire up github-token-for-extra-empty-commit #435).
• The token is currently only wired as env in compiled workflows, not as a caller input:
  • .github/workflows/gh-aw-issue-fixer.lock.yml:1608-1609
  • .github/workflows/gh-aw-pr-actions-fixer.lock.yml:1542-1543
• Safe-output fragments currently do not expose this field:
  • .github/workflows/gh-aw-fragments/safe-output-create-pr.md:17-19 (only draft)
  • .github/workflows/gh-aw-fragments/safe-output-push-to-pr.md:17-18 (no extra keys)
• Representative source workflows using these fragments define inputs like draft-prs, but no github-token-for-extra-empty-commit:
  • .github/workflows/gh-aw-issue-fixer.md:23-53
  • .github/workflows/gh-aw-pr-actions-fixer.md:19-49
• Related history confirms this gap existed during prior gh-aw upgrades:
  • [gh-aw-upgrade] gh-aw upgrade available: v0.49.2 → v0.50.0 #397 notes GH_AW_EXTRA_EMPTY_COMMIT_TOKEN rename to GH_AW_CI_TRIGGER_TOKEN and states no frontmatter wiring for github-token-for-extra-empty-commit.
• Related PR search found no prior implementation (github-search_pull_requests for this term returned 0 matches).

Best-of-three investigation result: all three parallel sub-agents independently converged on the same conclusion (missing caller-facing wiring; runtime env present only).

Verification

I verified with repository searches and direct file inspection:

$ rg -n "github-token-for-extra-empty-commit" .github/workflows/gh-aw-*.md
No matches found.

$ rg -n "safe-output-create-pr\.md|safe-output-push-to-pr\.md" .github/workflows/gh-aw-*.md
...17 workflow source files import one of these fragments...

$ rg -n "GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG|GH_AW_CI_TRIGGER_TOKEN" .github/workflows/gh-aw-issue-fixer.lock.yml
1608: GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{...create_pull_request...}"
1609: GH_AW_CI_TRIGGER_TOKEN: ${{ secrets.GH_AW_CI_TRIGGER_TOKEN }}

$ rg -n "GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG|GH_AW_CI_TRIGGER_TOKEN" .github/workflows/gh-aw-pr-actions-fixer.lock.yml
1542: GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{...push_to_pull_request_branch...}"
1543: GH_AW_CI_TRIGGER_TOKEN: ${{ secrets.GH_AW_CI_TRIGGER_TOKEN }}

Detailed Action Plan

1. Add workflow-call input in source workflows

   • For each workflow importing create/push fragments, add:
     • inputs.github-token-for-extra-empty-commit (type string, required false, default "").
   • Start with files confirmed in search (17 total), including:
     • .github/workflows/gh-aw-issue-fixer.md
     • .github/workflows/gh-aw-scheduled-fix.md
     • .github/workflows/gh-aw-pr-actions-fixer.md
     • .github/workflows/gh-aw-pr-review-addresser.md
     • .github/workflows/gh-aw-mention-in-pr*.md

2. Wire the input into safe-output fragments

   • Update .github/workflows/gh-aw-fragments/safe-output-create-pr.md to pass:
     • github-token-for-extra-empty-commit: ${{ inputs.github-token-for-extra-empty-commit }}
   • Update .github/workflows/gh-aw-fragments/safe-output-push-to-pr.md similarly.

3. Document the new input for callers

   • Update relevant gh-agent-workflows/*/README.md input tables (at least workflows exposing create PR or push-to-PR behavior).
   • Update relevant gh-agent-workflows/*/example.yml files with a commented example value, e.g.:
     • github-token-for-extra-empty-commit: ${{ secrets.GH_AW_CI_TRIGGER_TOKEN }}

4. Regenerate compiled workflows and validate

   • Run make compile and ensure lockfiles include the new wiring where applicable.
   • Run workflow lint/validation (make lint or repo-standard workflow lint target).

5. Back-compat behavior

   • Keep default empty value so existing consumers remain unchanged.
   • If empty, behavior should continue to rely on current default runtime behavior (no breaking change).

Related Items

Type	Link	Relevance
Issue	#435	Requested feature: expose github-token-for-extra-empty-commit
Issue	#397	Historical note: token rename + no frontmatter wiring found
Issue	#386	Prior upgrade tracking context
File	.github/workflows/gh-aw-fragments/safe-output-create-pr.md:17-19	create-PR safe-output config currently only includes draft
File	.github/workflows/gh-aw-fragments/safe-output-push-to-pr.md:17-18	push-to-PR safe-output config currently lacks token field
File	.github/workflows/gh-aw-issue-fixer.lock.yml:1608-1609	Runtime env sets GH_AW_CI_TRIGGER_TOKEN but not caller input wiring
File	.github/workflows/gh-aw-pr-actions-fixer.lock.yml:1542-1543	Same pattern for push-to-PR flow
PR search	repo:elastic/ai-github-actions "github-token-for-extra-empty-commit"	No matching PR implementation found

---

What is this? | From workflow: Issue Triage

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.