[jpr5]

What

Follow-up to #583 (and the same bug #581 had). When a refresh needs a human, the review PR was still pushed and opened with GITHUB_TOKEN. GitHub does not start workflows from GITHUB_TOKEN events, so CI never ran on that PR.

Before, in update-competitive-matrix.yml:

      - name: Configure git credentials
          git config --local url."https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/".insteadOf "https://github.com/"
      - name: Create PR
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

update-adoption-wall.yml had the same gap:

      - name: Open review PR
        env:
          GH_TOKEN: ${{ github.token }}

Change

• Both review paths push and open their PR with the copilotkit-bot App token. The token comes from the existing "Mint app token" step (same app, same pinned action, same secret, same contents/pull-requests write scopes). No new secret.
• The review PR is never merged by the workflow. It waits for a human, as before.
• The mint condition is now the union of the two steps that use the token:
  • competitive matrix: changed == 'true'
  • adoption wall: exists && changed && (status == 'safe' || status == 'needs-review')
• Least privilege for the workflow token: pull-requests: write is gone from both jobs. The competitive-matrix job is now contents: read, because its workflow token only reads the API now.
• The "Configure git credentials" step is removed. It wrote GITHUB_TOKEN into .git/config. The review step now passes the App token through git's environment config, like the auto-land step.

if: trace

Competitive matrix:

case	mint	auto-land	review PR
no change	skip	skip	skip
docs/ changed (confine skipped)	run	skip (docs_changed)	run (confined != 'true')
state only, confined	run	run	skip
state only, not confined	run	skip	run

Adoption wall: auto-land (exists && safe && changed && confined) and review (exists && changed && (needs-review || (safe && !confined))) are both subsets of the mint condition. A clean run, a run with no change, or a run with no state branch mints nothing.

Red-green proof

Contract test added to src/__tests__/competitive-matrix-slack.test.ts (review PRs are opened with the App token), for both workflows. It checks that the review step uses steps.app-token.outputs.token for push and PR, that no workflow-token git credential remains, that the review step never merges, and that the mint condition covers the review path.

RED (new test against the origin/main workflows):

⎯⎯⎯⎯⎯⎯⎯ Failed Tests 4 ⎯⎯⎯⎯⎯⎯⎯
 FAIL  src/__tests__/competitive-matrix-slack.test.ts > review PRs are opened with the App token > update-competitive-matrix.yml: "Create PR" pushes and opens the PR on the App token
 FAIL  src/__tests__/competitive-matrix-slack.test.ts > review PRs are opened with the App token > update-competitive-matrix.yml: the App token is minted for the review path too
 FAIL  src/__tests__/competitive-matrix-slack.test.ts > review PRs are opened with the App token > update-adoption-wall.yml: "Open review PR" pushes and opens the PR on the App token
 FAIL  src/__tests__/competitive-matrix-slack.test.ts > review PRs are opened with the App token > update-adoption-wall.yml: the App token is minted for the review path too
      Tests  4 failed | 7 passed (11)

GREEN (same test against this branch):

      Tests  11 passed (11)

Full suite: 483 files, 19670 tests passed. actionlint exit 0. zizmor --offline exit 0 (no findings). typecheck, eslint and prettier clean.

End-to-end proof

Not triggered by hand: mock-server.com currently returns 403, so a run would fail before these steps. The end-to-end proof is the next scheduled Monday run.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@copilotkit/aimock@586

commit: fb20157