Allow composite shell steps to use github.token

docs/compatibility.md

@@ -876,8 +876,10 @@ context listed below, including `token`, with sorted keys and two-space
 indentation.
 
 The compiler treats that call as a token reference, so normal permissions,
-admission, and redaction apply. Composite steps can consume an already
-authorized context, but composite metadata cannot grant token authority. A
+admission, and redaction apply. A reachable direct `github.token` reference in
+a composite shell step's `run`, `env`, or `working-directory` can request the
+token. Composite metadata can consume an already authorized serialized context,
+but serialization and nested action inputs cannot grant token authority. A
 tokenless context is an error.
 
 Job-level fields and action input defaults cannot call `toJSON(github)`. Bare,
@@ -1211,8 +1213,8 @@ JavaScript and Docker actions with compatible bundled cache clients also receive
 event repository when it:
 
 - statically references `secrets.GITHUB_TOKEN` or `github.token`; or
-- uses an action whose effective input default can reach `github.token` for the
-  event provider.
+- uses an action whose effective input default or reachable composite shell
+  step template can reach `github.token` for the event provider.
 
 A `github.server_url == 'https://github.com'` guard skips the token branch for
 an Origin repository. Native adapters ignore upstream input defaults, so

internal/cli/hosted.go

@@ -429,7 +429,7 @@ func githubTokenAdmissionDiagnostic(artifact compiler.PlanArtifact, reason strin
 		if len(quoted) > 1 {
 			actionLabel = "actions"
 		}
-		causes = append(causes, actionLabel+" "+strings.Join(quoted, ", ")+" defaults an input to github.token")
+		causes = append(causes, actionLabel+" "+strings.Join(quoted, ", ")+" references github.token in metadata")
 	}
 	if len(causes) == 0 {
 		causes = append(causes, "the compiled job requests a workflow token")

internal/compiler/actions.go

@@ -439,7 +439,27 @@ func (n *actionNode) inspectInvocation(supplied map[string]string, workflowAutho
 	if n.runtime != metadata.RuntimeComposite {
 		return requirements, nil
 	}
+	knownReferences := n.knownInputReferences(supplied, serverURL)
 	for i, step := range n.metadata.Runs.Steps {
+		if step.Uses == "" {
+			mayRun := compositeStepMayRun(step.If, knownReferences)
+			for _, field := range []struct {
+				name  string
+				value string
+			}{
+				{name: "run", value: step.Run},
+				{name: "working-directory", value: step.WorkingDirectory},
+			} {
+				if err := inspectCompositeStepTemplate(fmt.Sprintf("step %d %s", i+1, field.name), field.value, knownReferences, mayRun, &requirements); err != nil {
+					return actionRequirements{}, err
+				}
+			}
+			for _, name := range sortedKeys(step.Env) {
+				if err := inspectCompositeStepTemplate(fmt.Sprintf("step %d environment %q", i+1, name), step.Env[name], knownReferences, mayRun, &requirements); err != nil {
+					return actionRequirements{}, err
+				}
+			}
+		}
 		if step.Uses == "" {
 			continue
 		}
@@ -465,6 +485,62 @@ func (n *actionNode) inspectInvocation(supplied map[string]string, workflowAutho
 	return requirements, nil
 }
 
+func (n *actionNode) knownInputReferences(supplied map[string]string, serverURL string) map[string]any {
+	known := map[string]any{"github.server_url": serverURL}
+	for _, name := range sortedKeys(n.metadata.Inputs) {
+		input := n.metadata.Inputs[name]
+		if input.Default == nil || hasActionInput(supplied, name) {
+			continue
+		}
+		value, resolved, err := expression.EvaluateKnownActionInputDefault(*input.Default, serverURL)
+		if err != nil || !resolved {
+			continue
+		}
+		known["inputs."+strings.ToLower(name)] = value
+	}
+	for _, name := range sortedKeys(supplied) {
+		if strings.Contains(supplied[name], "${{") {
+			continue
+		}
+		known["inputs."+strings.ToLower(name)] = supplied[name]
+	}
+	return known
+}
+
+func compositeStepMayRun(condition string, knownReferences map[string]any) bool {
+	if referencesStatus, err := expression.ReferencesStatusFunction(condition); err != nil || referencesStatus {
+		return true
+	}
+	run, err := expression.ConditionMayBeTrue(condition, knownReferences)
+	return err != nil || run
+}
+
+func inspectCompositeStepTemplate(field, template string, knownReferences map[string]any, reachable bool, requirements *actionRequirements) error {
+	if template == "" {
+		return nil
+	}
+	referencesEvent, err := expression.TemplateReferencesGitHubEvent(template)
+	if err != nil {
+		return fmt.Errorf("composite action %s: %w", field, err)
+	}
+	if referencesEvent {
+		return fmt.Errorf("composite action %s: github.event cannot be retained in a job plan", field)
+	}
+	names, err := expression.SecretReferences(template)
+	if err != nil {
+		return fmt.Errorf("composite action %s: %w", field, err)
+	}
+	if len(names) != 0 {
+		return fmt.Errorf("composite action %s: composite action metadata cannot grant secret authority", field)
+	}
+	referencesToken, err := expression.StepTemplateRequiresGitHubToken(template, knownReferences)
+	if err != nil {
+		return fmt.Errorf("composite action %s: %w", field, err)
+	}
+	requirements.githubToken = requirements.githubToken || reachable && referencesToken
+	return nil
+}
+
 func hasActionInput(inputs map[string]string, name string) bool {
 	for candidate := range inputs {
 		if strings.EqualFold(candidate, name) {