From b24ea4e4610f5c68688c905377042556e56e5a63 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 4 Jul 2026 15:01:03 +0100 Subject: [PATCH] fix(ci): correct 3 secret-name mismatches causing silent no-ops MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Found during a post-breach credential audit: these workflows reference secret names that don't exist on this repo, so the affected steps silently degrade (empty token / fallback) instead of failing loudly. - supervised-fleet-scan.yml: referenced secrets.FLEET_SCAN_PAT, which has never existed here — only HYPATIA_SCAN_PAT is configured, and its scope (Contents+Dependabot alerts read) is exactly what this step's own comment says it needs. Pointed it at the secret that actually exists. - inbox-steward.yml "Validate PRs": referenced secrets.FARM_PAT (never configured). This step only reads check-runs/reviews/PRs on this same repo — it never needed a cross-repo PAT. Switched to secrets.GITHUB_TOKEN, which is sufficient and always present. - inbox-steward.yml "Send dispatch to Hypatia": same missing FARM_PAT reference, but this step genuinely dispatches cross-repo, so it keeps the same PAT-with-fallback shape — just pointed at FARM_DISPATCH_TOKEN, the secret that's actually meant to carry that capability (currently dead pending redistribution of the new FARM_DISPATCH_PAT value, tracked separately). Co-Authored-By: Claude Sonnet 5 --- .github/workflows/inbox-steward.yml | 4 ++-- .github/workflows/supervised-fleet-scan.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/inbox-steward.yml b/.github/workflows/inbox-steward.yml index 8e435567..b3f3c326 100644 --- a/.github/workflows/inbox-steward.yml +++ b/.github/workflows/inbox-steward.yml @@ -166,7 +166,7 @@ jobs: - name: Validate PRs id: validate env: - GH_TOKEN: ${{ secrets.FARM_PAT }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} PRS_JSON: ${{ needs.identify-passed-prs.outputs.prs_to_process }} DRY_RUN: ${{ inputs.dry_run }} run: | @@ -384,7 +384,7 @@ jobs: - name: Send dispatch to Hypatia env: - GH_TOKEN: ${{ secrets.FARM_PAT || secrets.GITHUB_TOKEN }} + GH_TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN || secrets.GITHUB_TOKEN }} PR_COUNT: ${{ needs.identify-passed-prs.outputs.pr_count }} VALIDATED_JSON: ${{ needs.validate-prs.outputs.validated_prs || '[]' }} MERGED_COUNT: ${{ needs.auto-merge-prs.outputs.merged_count || '0' }} diff --git a/.github/workflows/supervised-fleet-scan.yml b/.github/workflows/supervised-fleet-scan.yml index ab440b4d..66da24f2 100644 --- a/.github/workflows/supervised-fleet-scan.yml +++ b/.github/workflows/supervised-fleet-scan.yml @@ -46,14 +46,14 @@ jobs: INVENTORY_FILE: ${{ github.event.inputs.inventory_file || '' }} PROCESS_FINDINGS: ${{ github.event.inputs.process_findings || 'true' }} FLEET_SUPERVISED_REPOS_FILE: ${{ github.event.inputs.inventory_file || '' }} - # FLEET_SCAN_PAT is required for Hypatia's DependabotAlerts + # HYPATIA_SCAN_PAT is required for Hypatia's DependabotAlerts # rule (DA001-DA004) to query per-repo Dependabot alerts via # the GitHub REST API. This PAT must have `security_events: read` # scope on ALL target repos. Without it, cross-repo alerts will # be MISSING. The built-in GITHUB_TOKEN is insufficient for # estate-wide scanning. See: # 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md. - GITHUB_TOKEN: ${{ secrets.FLEET_SCAN_PAT }} + GITHUB_TOKEN: ${{ secrets.HYPATIA_SCAN_PAT }} # HYPATIA_SEVERITY=low surfaces low-severity findings from # every rule module. The Hypatia CLI's default threshold is # "medium"; without this override, low-severity findings