What
Accept ${{ steps.<id>.outputs.<name> }} in safe-outputs.github-token (And similar attributes), so a Vault/OIDC fetch in jobs.safe_outputs.pre-steps / setup-steps can feed Process Safe Outputs.
Why
Cross-job needs.*.outputs.token is unusable: masked tokens are dropped at the job boundary. Same-job pre-steps work, but github-token still rejects steps.* (secrets.* / needs.* only), so secret-manager tokens can’t be wired into safe-outputs without a long-lived PAT.
What
Accept
${{ steps.<id>.outputs.<name> }}insafe-outputs.github-token(And similar attributes), so a Vault/OIDC fetch injobs.safe_outputs.pre-steps/setup-stepscan feedProcess Safe Outputs.Why
Cross-job
needs.*.outputs.tokenis unusable: masked tokens are dropped at the job boundary. Same-jobpre-stepswork, butgithub-tokenstill rejectssteps.*(secrets.*/needs.*only), so secret-manager tokens can’t be wired into safe-outputs without a long-lived PAT.