Skip to content

fix: use GITHUB_TOKEN instead of PAT_TOKEN across all workflows #104

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Tony363 merged 4 commits into from
Mar 29, 2026
Merged

fix: use GITHUB_TOKEN instead of PAT_TOKEN across all workflows #104

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1f670b9
fix: use GITHUB_TOKEN instead of PAT_TOKEN for issue-to-pr
Tony363 Mar 28, 2026
24ee4c4
fix: remove PAT_TOKEN dependency from all remaining workflows
Tony363 Mar 29, 2026
2b23467
docs: add architecture documentation
Tony363 Mar 29, 2026
66d0679
Merge branch 'main' into fix/use-github-token
Tony363 Mar 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/AUTONOMOUS_SCANNER_IMPLEMENTATION_SUMMARY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ The autonomous overnight code scanner is **100% implemented** with all AI integr
**Job 1: Pre-Flight Security Check**
- ✅ Protected file filtering (workflows, secrets, auth, pipeline, prompts, migrations)
- ✅ Generates scannable file lists (~450 Python, ~220 TypeScript)
- ✅ Secret validation (PAT_TOKEN, ANTHROPIC_API_KEY)
- ✅ Secret validation (ANTHROPIC_API_KEY)
- ✅ Uploads artifacts for downstream jobs
- ⏱️ Runtime: ~5 minutes
- 💰 Cost: $0
Expand Down
6 changes: 2 additions & 4 deletions .github/AUTONOMOUS_SCANNER_QUICKSTART.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -297,9 +297,7 @@ fi

**Solution**: Add secrets to repository
```bash
# Add PAT_TOKEN (for PR creation)
gh secret set PAT_TOKEN
# Paste token with repo + workflow scopes
# GITHUB_TOKEN is automatic — no PAT needed for PR creation

# Add ANTHROPIC_API_KEY (for AI features)
gh secret set ANTHROPIC_API_KEY
Expand All @@ -324,7 +322,7 @@ gh run view <run-id> --web
**Solutions**:
1. Check dry run mode: `--field dry_run=false`
2. Check if changes detected: View step summary
3. Check PAT_TOKEN permissions: repo + workflow scopes
3. Check GITHUB_TOKEN write permissions in repo Settings > Actions

### Protected Files Modified

Expand Down
17 changes: 7 additions & 10 deletions .github/AUTONOMOUS_SCANNER_STATUS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
- Generates scannable Python/TypeScript file lists
- Uploads artifacts for downstream jobs
- File count reporting in step summary
- Secret validation (PAT_TOKEN, ANTHROPIC_API_KEY)
- Secret validation (ANTHROPIC_API_KEY)

**✅ Job 4: Cost Tracker & Budget Gates**
- Calculates total cost from P0/P1 jobs
Expand Down Expand Up @@ -254,16 +254,15 @@ Add these to GitHub repository secrets:

| Secret | Purpose | Scope |
|--------|---------|-------|
| `PAT_TOKEN` | PR creation | repo + workflow |
| `GITHUB_TOKEN` | PR creation, checkout, comments | Automatically provided |
| `ANTHROPIC_API_KEY` | Claude API (consensus, types, docs) | API key from console.anthropic.com |

**Validation**:
```bash
# Check secrets exist
# Check secrets exist (GITHUB_TOKEN is automatic)
gh secret list

# Expected output:
# PAT_TOKEN Updated YYYY-MM-DD
# ANTHROPIC_API_KEY Updated YYYY-MM-DD
```

Expand All @@ -277,11 +276,10 @@ gh secret list

**Solution**:
```bash
# Verify secrets exist
# Verify secrets exist (GITHUB_TOKEN is automatic)
gh secret list

# Add missing secrets
gh secret set PAT_TOKEN
gh secret set ANTHROPIC_API_KEY
```

Expand Down Expand Up @@ -310,11 +308,10 @@ gh workflow run autonomous-code-scanner.yml \
--field dry_run=false
```

**Solution 2**: Check PAT_TOKEN permissions
**Solution 2**: Check GITHUB_TOKEN permissions
```bash
# PAT must have:
# - repo (full control)
# - workflow (update workflows)
# Ensure workflow has write permissions:
# Settings > Actions > General > Workflow permissions > Read and write
```

### Protected Files Modified
Expand Down
10 changes: 3 additions & 7 deletions .github/workflows/CLAUDE_REVIEW_SETUP.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,9 +81,7 @@ PAL_MCP_ENDPOINT=https://your-pal-mcp-server.com/api/tools/consensus

#### Phase 3 (Additional):
```
PAT_TOKEN=<github-personal-access-token>
# Required scopes: repo, workflow
# Create at: https://github.com/settings/tokens
# PAT_TOKEN is no longer required — GITHUB_TOKEN is used for all operations
```

### 3. PAL MCP Setup (Phase 2 & 3)
Expand Down Expand Up @@ -149,8 +147,7 @@ gh secret set CLAUDE_CODE_OAUTH_TOKEN
gh secret set PAL_MCP_API_KEY
gh secret set PAL_MCP_ENDPOINT --body "https://your-endpoint.com/api/tools/consensus"

# Phase 3: Add PAT
gh secret set PAT_TOKEN
# Phase 3: PAT_TOKEN no longer required (GITHUB_TOKEN is used)
```

### Step 3: Create CLAUDE.md (Optional but Recommended)
Expand Down Expand Up @@ -403,8 +400,7 @@ gh run view <run-id> --log
### Issue: Draft PR not created (Phase 3)

**Common causes**:
1. **No PAT_TOKEN**: Phase 3 requires PAT with `repo` scope
2. **Protected branch**: Claude can't push to `main` directly
1. **Protected branch**: GITHUB_TOKEN can't push to protected branches directly
3. **Consensus rejected changes**: Check workflow logs for recommendation
4. **Security block**: Modifying protected files (`.github/`, secrets)
Comment on lines +403 to 405

@coderabbitai coderabbitai Bot Mar 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

List numbering is broken after removing PAT_TOKEN item.

The numbered list jumps from 1 to 3, indicating item 2 (likely the old PAT_TOKEN check) was removed but the subsequent items weren't renumbered.

📝 Proposed fix 
 ### Issue: Draft PR not created (Phase 3)
 
 **Common causes**:
 1. **Protected branch**: GITHUB_TOKEN can't push to protected branches directly
-3. **Consensus rejected changes**: Check workflow logs for recommendation
-4. **Security block**: Modifying protected files (`.github/`, secrets)
+2. **Consensus rejected changes**: Check workflow logs for recommendation
+3. **Security block**: Modifying protected files (`.github/`, secrets)
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
1. **Protected branch**: GITHUB_TOKEN can't push to protected branches directly
3. **Consensus rejected changes**: Check workflow logs for recommendation
4. **Security block**: Modifying protected files (`.github/`, secrets)
1. **Protected branch**: GITHUB_TOKEN can't push to protected branches directly
2. **Consensus rejected changes**: Check workflow logs for recommendation
3. **Security block**: Modifying protected files (`.github/`, secrets)
🧰 Tools
🪛 LanguageTool

[uncategorized] ~405-~405: The official name of this software platform is spelled with a capital “H”.
Context: ...ity block**: Modifying protected files (.github/, secrets) Debug: ```bash # Check...

(GITHUB)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/CLAUDE_REVIEW_SETUP.md around lines 403 - 405, The
numbered list in the markdown has a broken sequence (1, then 3, 4) because the
removed PAT_TOKEN item wasn't renumbered; update the list in the
CLAUDE_REVIEW_SETUP.md section where the three list items about protected branch
/ consensus / security block appear so the numbering is consecutive (1, 2, 3) by
renumbering the items or converting to an auto-numbered list (use "1." for each
line) to ensure correct ordering.


Expand Down
5 changes: 1 addition & 4 deletions .github/workflows/DEPLOYMENT_STATUS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,10 +67,7 @@ gh secret set CLAUDE_CODE_OAUTH_TOKEN
gh secret set PAL_MCP_API_KEY
gh secret set PAL_MCP_ENDPOINT

# Required for Phase 3 only (PR creation)
gh secret set PAT_TOKEN
# Create at: https://github.com/settings/tokens
# Scopes: repo, workflow
# Phase 3: PAT_TOKEN no longer required (GITHUB_TOKEN is used for PR creation)
```

### Step 3: Install Claude GitHub App
Expand Down
4 changes: 1 addition & 3 deletions .github/workflows/README_CLAUDE_REVIEW.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,9 +91,7 @@ This implementation provides a **three-phase approach** to AI code review:
- `PAL_MCP_ENDPOINT` - PAL MCP API URL (optional, has default)

### Phase 3:
- `PAT_TOKEN` - GitHub Personal Access Token
- Scopes: `repo`, `workflow`
- [Create here](https://github.com/settings/tokens)
- Uses `GITHUB_TOKEN` (automatically provided, no additional secrets needed)

---

Expand Down
15 changes: 5 additions & 10 deletions .github/workflows/autonomous-code-scanner.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,13 +47,8 @@ jobs:

- name: Validate required secrets
env:
HAS_PAT: ${{ secrets.PAT_TOKEN != '' }}
HAS_ANTHROPIC: ${{ secrets.ANTHROPIC_API_KEY != '' }}
run: |
if [ "$HAS_PAT" != "true" ]; then
echo "::error::PAT_TOKEN required for PR creation"
exit 1
fi
if [ "$HAS_ANTHROPIC" != "true" ]; then
echo "::error::ANTHROPIC_API_KEY required for scanning"
exit 1
Expand Down Expand Up @@ -797,7 +792,7 @@ jobs:
- name: Checkout code
uses: actions/checkout@v6
with:
token: ${{ secrets.PAT_TOKEN }}
token: ${{ secrets.GITHUB_TOKEN }}
fetch-depth: 0

- name: Download all artifacts
Expand Down Expand Up @@ -899,7 +894,7 @@ jobs:
github.event.inputs.dry_run != 'true'
uses: peter-evans/create-pull-request@v8
with:
token: ${{ secrets.PAT_TOKEN }}
token: ${{ secrets.GITHUB_TOKEN }}
branch: scanner/formatting-${{ github.run_id }}
draft: true
delete-branch: true
Expand Down Expand Up @@ -940,7 +935,7 @@ jobs:
github.event.inputs.dry_run != 'true'
uses: peter-evans/create-pull-request@v8
with:
token: ${{ secrets.PAT_TOKEN }}
token: ${{ secrets.GITHUB_TOKEN }}
branch: scanner/security-${{ github.run_id }}
draft: true
delete-branch: true
Expand Down Expand Up @@ -1005,7 +1000,7 @@ jobs:
github.event.inputs.dry_run != 'true'
uses: peter-evans/create-pull-request@v8
with:
token: ${{ secrets.PAT_TOKEN }}
token: ${{ secrets.GITHUB_TOKEN }}
branch: scanner/type-hints-${{ github.run_id }}
draft: true
delete-branch: true
Expand Down Expand Up @@ -1074,7 +1069,7 @@ jobs:
github.event.inputs.dry_run != 'true'
uses: peter-evans/create-pull-request@v8
with:
token: ${{ secrets.PAT_TOKEN }}
token: ${{ secrets.GITHUB_TOKEN }}
branch: scanner/documentation-${{ github.run_id }}
draft: true
delete-branch: true
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/claude-review-phase3.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,7 @@ jobs:
uses: actions/checkout@v6
with:
fetch-depth: 0
token: ${{ secrets.PAT_TOKEN || secrets.GITHUB_TOKEN }}
token: ${{ secrets.GITHUB_TOKEN }}

# ========== PRIMARY: AWS Bedrock ==========
- name: Claude Review (Bedrock - Primary)
Expand All @@ -104,7 +104,7 @@ jobs:
continue-on-error: true
uses: anthropics/claude-code-action@v1
with:
github_token: ${{ secrets.PAT_TOKEN || secrets.GITHUB_TOKEN }}
github_token: ${{ secrets.GITHUB_TOKEN }}
use_bedrock: "true"
timeout_minutes: 15
claude_args: >-
Expand All @@ -125,7 +125,7 @@ jobs:
continue-on-error: true
uses: anthropics/claude-code-action@v1
with:
github_token: ${{ secrets.PAT_TOKEN || secrets.GITHUB_TOKEN }}
github_token: ${{ secrets.GITHUB_TOKEN }}
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
timeout_minutes: 15
claude_args: >-
Expand Down Expand Up @@ -247,7 +247,7 @@ jobs:
uses: actions/checkout@v6
with:
fetch-depth: 0
token: ${{ secrets.PAT_TOKEN || secrets.GITHUB_TOKEN }}
token: ${{ secrets.GITHUB_TOKEN }}

- name: Download patch
uses: actions/download-artifact@v8
Expand Down Expand Up @@ -277,7 +277,7 @@ jobs:
id: create_pr
uses: peter-evans/create-pull-request@v8
with:
token: ${{ secrets.PAT_TOKEN || secrets.GITHUB_TOKEN }}
token: ${{ secrets.GITHUB_TOKEN }}
commit-message: |
AI-suggested improvements from PR #${{ github.event.pull_request.number }}

Expand Down Expand Up @@ -411,7 +411,7 @@ jobs:

# Required secrets:
# - GITHUB_TOKEN (automatically provided)
# - PAT_TOKEN (Personal Access Token with repo scope, optional)
# - (PAT_TOKEN removed — GITHUB_TOKEN is used for all operations)
# - ANTHROPIC_API_KEY or AWS_BEARER_TOKEN_BEDROCK (at least one required)
# - PAL_MCP_API_KEY (optional - consensus skipped if missing)
# - PAL_MCP_ENDPOINT (optional - has default)
Expand Down
17 changes: 6 additions & 11 deletions .github/workflows/issue-to-pr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,15 +39,10 @@ jobs:
env:
BEDROCK_CONFIGURED: ${{ secrets.AWS_BEARER_TOKEN_BEDROCK != '' }}
ANTHROPIC_KEY_SET: ${{ secrets.ANTHROPIC_API_KEY != '' }}
HAS_PAT: ${{ secrets.PAT_TOKEN != '' }}

steps:
- name: Validate required secrets
run: |
if [ "$HAS_PAT" != "true" ]; then
echo "::error::PAT_TOKEN required for PR creation"
exit 1
fi
if [ "$BEDROCK_CONFIGURED" != "true" ] && [ "$ANTHROPIC_KEY_SET" != "true" ]; then
echo "::error::No API provider configured. Add AWS Bedrock credentials OR ANTHROPIC_API_KEY."
exit 1
Expand All @@ -57,7 +52,7 @@ jobs:
- name: Check for duplicate PRs
id: dedup
env:
GH_TOKEN: ${{ secrets.PAT_TOKEN }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
EXISTING_PR=$(gh pr list --repo "${{ github.repository }}" --state open \
--json number,headRefName \
Expand Down Expand Up @@ -90,7 +85,7 @@ jobs:
uses: actions/checkout@v6
with:
fetch-depth: 0
token: ${{ secrets.PAT_TOKEN }}
token: ${{ secrets.GITHUB_TOKEN }}

- name: Setup Node.js
uses: actions/setup-node@v6
Expand Down Expand Up @@ -355,7 +350,7 @@ jobs:
if: needs.guardrails.outputs.passed == 'true'
uses: actions/checkout@v6
with:
token: ${{ secrets.PAT_TOKEN }}
token: ${{ secrets.GITHUB_TOKEN }}

- name: Download clean patch
if: needs.guardrails.outputs.passed == 'true'
Expand All @@ -373,7 +368,7 @@ jobs:
if: needs.guardrails.outputs.passed == 'true'
uses: peter-evans/create-pull-request@v8
with:
token: ${{ secrets.PAT_TOKEN }}
token: ${{ secrets.GITHUB_TOKEN }}
branch: issue-fix/${{ github.event.issue.number }}-${{ github.run_id }}
delete-branch: true
draft: true
Expand Down Expand Up @@ -408,7 +403,7 @@ jobs:
- name: Comment on issue (success)
if: needs.guardrails.outputs.passed == 'true' && steps.create.outputs.pull-request-number
env:
GH_TOKEN: ${{ secrets.PAT_TOKEN }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
gh issue comment "${{ github.event.issue.number }}" \
--repo "${{ github.repository }}" \
Expand All @@ -434,7 +429,7 @@ jobs:
- name: Comment on issue (no PR)
if: needs.guardrails.outputs.passed != 'true' && needs.validate.outputs.should_proceed == 'true'
env:
GH_TOKEN: ${{ secrets.PAT_TOKEN }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
FAILURE_REASON: ${{ steps.failure.outputs.reason }}
run: |
gh issue comment "${{ github.event.issue.number }}" \
Expand Down
24 changes: 1 addition & 23 deletions .github/workflows/setup-claude-review.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,29 +160,7 @@ configure_secrets() {
fi
fi

# PAT Token (required for Phase 3)
if [ "$PHASE" == "phase3" ] || [ "$PHASE" == "all" ]; then
if ! echo "$SECRET_LIST" | grep -q "PAT_TOKEN"; then
warning "PAT_TOKEN not found (required for PR creation)"
echo ""
echo "📋 Steps to create PAT token:"
echo " 1. Visit https://github.com/settings/tokens"
echo " 2. Generate new token (classic)"
echo " 3. Required scopes: repo, workflow"
echo " 4. Copy the token"
echo ""
read -rp "Paste your PAT token (or press Enter to skip): " pat_token

if [ -n "$pat_token" ]; then
echo "$pat_token" | gh secret set PAT_TOKEN
success "PAT_TOKEN configured"
else
warning "PAT_TOKEN not configured - Phase 3 PR creation will not work"
fi
else
success "PAT_TOKEN already configured"
fi
fi
# Note: PAT_TOKEN is no longer required — all workflows use GITHUB_TOKEN
}

# Install workflow files
Expand Down
Loading