From 8a0e2ca92edca36e7f4884d0bc084b613414b30b Mon Sep 17 00:00:00 2001
From: peptiderepo <273788462+peptiderepo@users.noreply.github.com>
Date: Tue, 14 Apr 2026 17:35:04 +0700
Subject: [PATCH] ci: stop exposing CTO_ADMIN_TOKEN as env var (security
 cleanup)

Pass the PAT only via github-token param. continue-on-error on the
budget step so a missing/expired secret degrades gracefully instead
of failing the whole workflow.

Agent-Session: cowork-reviewer-ab-20260414
---
 .github/workflows/cto-review.yml | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/cto-review.yml b/.github/workflows/cto-review.yml
index a313fcb..0c501f3 100644
--- a/.github/workflows/cto-review.yml
+++ b/.github/workflows/cto-review.yml
@@ -39,19 +39,16 @@ jobs:
         # Counter lives in Repository Variables (CTO_REVIEW_MONTH,
         # CTO_REVIEW_SPEND_CENTS, CTO_REVIEW_CAP_CENTS). Auth via CTO_ADMIN_TOKEN
         # (a PAT) because default GITHUB_TOKEN cannot mutate Repo Variables.
+        # SECURITY: CTO_ADMIN_TOKEN is passed ONLY via github-token param. It is
+        # NOT exposed as an env var in this step to avoid leak surface area.
+        # If the secret is missing, github.rest.actions.* calls throw 401 and
+        # the try/catch treats it as "tracking disabled" — review still runs.
         id: budget
+        continue-on-error: true
         uses: actions/github-script@v7
-        env:
-          ADMIN_TOKEN: ${{ secrets.CTO_ADMIN_TOKEN }}
         with:
           github-token: ${{ secrets.CTO_ADMIN_TOKEN }}
           script: |
-            if (!process.env.ADMIN_TOKEN) {
-              core.warning('CTO_ADMIN_TOKEN not set — skipping budget cap (reviewer will still run but spend is untracked).');
-              core.setOutput('skip', 'false');
-              core.setOutput('tracking', 'false');
-              return;
-            }
             const month = new Date().toISOString().slice(0,7);
             const get = async (name) => {
               try {