peptide-repo/prautoblogger
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: stop exposing CTO_ADMIN_TOKEN as env var (security cleanup)

Browse Source 
Pass the PAT only via github-token param. continue-on-error on the
budget step so a missing/expired secret degrades gracefully instead
of failing the whole workflow.

Agent-Session: cowork-reviewer-ab-20260414
This commit is contained in:
peptiderepo
2026-04-14 17:34:57 +07:00
parent 1dc1eb5e07
commit 8e86257237
1 changed files with 5 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
.github/workflows/cto-review.yml vendored
View File

@@ -39,19 +39,16 @@ jobs:
# Counter lives in Repository Variables (CTO_REVIEW_MONTH, # Counter lives in Repository Variables (CTO_REVIEW_MONTH,
# CTO_REVIEW_SPEND_CENTS, CTO_REVIEW_CAP_CENTS). Auth via CTO_ADMIN_TOKEN # CTO_REVIEW_SPEND_CENTS, CTO_REVIEW_CAP_CENTS). Auth via CTO_ADMIN_TOKEN
# (a PAT) because default GITHUB_TOKEN cannot mutate Repo Variables. # (a PAT) because default GITHUB_TOKEN cannot mutate Repo Variables.
# SECURITY: CTO_ADMIN_TOKEN is passed ONLY via github-token param. It is
# NOT exposed as an env var in this step to avoid leak surface area.
# If the secret is missing, github.rest.actions.* calls throw 401 and
# the try/catch treats it as "tracking disabled" — review still runs.
id: budget id: budget
continue-on-error: true
uses: actions/github-script@v7 uses: actions/github-script@v7
env:
ADMIN_TOKEN: ${{ secrets.CTO_ADMIN_TOKEN }}
with: with:
github-token: ${{ secrets.CTO_ADMIN_TOKEN }} github-token: ${{ secrets.CTO_ADMIN_TOKEN }}
script: | script: |
if (!process.env.ADMIN_TOKEN) {
core.warning('CTO_ADMIN_TOKEN not set — skipping budget cap (reviewer will still run but spend is untracked).');
core.setOutput('skip', 'false');
core.setOutput('tracking', 'false');
return;
}
const month = new Date().toISOString().slice(0,7); const month = new Date().toISOString().slice(0,7);
const get = async (name) => { const get = async (name) => {
try { try {