Fix codeowner-update auth: add github-token for PR creation

[aaronpowell]

The create-pull-request safe output was failing with:

remote: Invalid username or token. Password authentication is not supported for Git operations.

The default GITHUB_TOKEN cannot push branches in this org. This adds github-token: ${{ secrets.GH_AW_GITHUB_TOKEN }} to the create-pull-request safe output so the compiled lock file uses a token with write permissions.

Note: The GH_AW_GITHUB_TOKEN secret must be configured in the repo with contents: write and pull-requests: write permissions.

[Copilot]

Pull request overview

Updates the Codeowner Update agentic workflow to use an explicit write-capable token when creating pull requests, addressing Git auth failures caused by this org’s default GITHUB_TOKEN being unable to push branches.

Changes:

• Add github-token: ${{ secrets.GH_AW_GITHUB_TOKEN }} to the create-pull-request safe output configuration.
• Regenerate the compiled workflow so the safe-outputs PR-creation path uses GH_AW_GITHUB_TOKEN for checkout and git remote authentication.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/codeowner-update.md	Configures the create-pull-request safe output to use GH_AW_GITHUB_TOKEN.
.github/workflows/codeowner-update.lock.yml	Compiled workflow updates checkout + git auth to use GH_AW_GITHUB_TOKEN during PR creation.

---

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

github-token is now required for PR creation, but the workflow doesn’t appear to validate that secrets.GH_AW_GITHUB_TOKEN is set/non-empty. If it’s missing, failures later in the run can be hard to diagnose. Consider adding an explicit validation step (similar to the existing COPILOT_GITHUB_TOKEN validation) to fail fast with a clear message.

[Copilot]

actions/checkout now uses token: ${{ secrets.GH_AW_GITHUB_TOKEN }} without a fallback. If the secret is missing/empty in a new environment, checkout/push will fail with an auth error. A small fail-fast validation for GH_AW_GITHUB_TOKEN earlier in the workflow would make this easier to troubleshoot.