Add individual github-token support for handler-managed safe outputs

[Copilot]

Three newly added integration tests were failing due to incomplete support for individual github-token properties on safe output configurations.

Changes

• Schema: Added github-token property to 11 safe output types (create-issue, add-comment, update-issue, etc.) that were missing it in main_workflow_schema.json

• Token precedence: Implemented getFirstHandlerIndividualToken() to resolve tokens for the consolidated handler manager step with precedence: individual token → safe-outputs global → top-level → default

• Test expectations: Updated tests to expect process_safe_outputs step ID instead of individual step IDs for handler-managed outputs

Example

safe-outputs:
  github-token: ${{ secrets.SAFE_OUTPUTS_PAT }}
  create-issue:
    github-token: ${{ secrets.ISSUE_SPECIFIC_PAT }}  # Now supported

The handler manager step now uses ISSUE_SPECIFIC_PAT when present, falling back to SAFE_OUTPUTS_PAT if not specified.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/user
  • Triggering command: /usr/bin/gh gh api user --jq .login b/workflows 4569543/b392/_testmain.go /home/REDACTED/go/pkg/mod/golang.org/[email protected]/pkg/tool/linux_amd64/link -s -w -buildmode=exe /home/REDACTED/go/pkg/mod/golang.org/[email protected] -o ithub/workflows -importcfg /usr/bin/git -s -w -buildmode=exe git (http block)
  • Triggering command: /usr/bin/gh gh api user --jq .login -test.paniconexit0 -test.v=true (http block)
  • Triggering command: /usr/bin/gh gh api user --jq .login tags/v5 origin 1e55e9d28eba8914107888677bf22ef4f6c/log.json by/d4a4a629fc7f3infocmp rE6U/17gxpsi6sEq-1 /home/REDACTED/go/xterm-color git rev-�� 749e02e28142627b /home/REDACTED/go/pkg/mod/golang.oconfig e/git runs/20251231-03/usr/bin/containerd-shim-runc-v2 pkg/mod/golang.o-namespace ache/node/24.12.moby e/git (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Fix tests

Custom agent used: ci-cleaner
Tidies up the repository CI state by formatting sources, running linters, fixing issues, running tests, and recompiling workflows

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[pelikhan]

@copilot revert change, remove GitHub-token per safe output type and fix tests