feat: implement issue #1327 — Collapse GH_PAT_DON_PETRY_COPILOT → GH_PAT_DON_PETRY (single don-petry PAT for the Copilot engine) - #1328
Conversation
…PAT_DON_PETRY (single don-petry PAT for the Copilot engine)
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Review limit reached
Next review available in: 31 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (7)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request retires the separate GH_PAT_DON_PETRY_COPILOT secret, consolidating Copilot authentication under the single GH_PAT_DON_PETRY PAT across documentation and workflow specifications. Feedback on the changes suggests adding a fallback to GH_PAT_WORKFLOWS for COPILOT_GITHUB_TOKEN in docs/dev-lead/spec.md to prevent potential breakages during the active migration transition.
Dev-Lead — review-changes (applied)Changes committed and pushed. |
There was a problem hiding this comment.
Pull request overview
This PR implements issue #1327 by standardizing Copilot engine authentication across this repo’s GitHub Actions workflows to use the single GH_PAT_DON_PETRY secret (and removing the deprecated _COPILOT/GH_PAT secret plumbing from reusable workflow interfaces), while updating docs to match the new token model.
Changes:
- Repointed all Copilot auth paths (
COPILOT_GITHUB_TOKEN, and relevantGH_TOKENcases) to${{ secrets.GH_PAT_DON_PETRY }}(preserving the|| secrets.GITHUB_TOKENdegradation leg where required). - Removed now-dead reusable
workflow_call.secretsdeclarations forGH_PAT_DON_PETRY_COPILOTand deprecatedGH_PATalias (indev-lead-reusable.ymlandpr-review.yml). - Updated documentation to reflect that Copilot access is an account entitlement and no separate Copilot PAT secret is needed.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
docs/pr-review-agent/machine-user-setup.md |
Updates secret naming guidance and migration notes to retire GH_PAT_DON_PETRY_COPILOT in favor of GH_PAT_DON_PETRY. |
docs/dev-lead/spec.md |
Updates the COPILOT_GITHUB_TOKEN example to use secrets.GH_PAT_DON_PETRY. |
AGENTS.md |
Removes GH_PAT_DON_PETRY_COPILOT from the PAT secret naming examples to match the single-token model. |
.github/workflows/readme-refresh.yml |
Switches GH_TOKEN to secrets.GH_PAT_DON_PETRY for the README refresh automation. |
.github/workflows/pr-review.yml |
Repoints COPILOT_GITHUB_TOKEN to secrets.GH_PAT_DON_PETRY and removes obsolete reusable secret declarations. |
.github/workflows/gh-aw-cross-org.yml |
Repoints COPILOT_GITHUB_TOKEN and updates the engine-install GH_TOKEN to `secrets.GH_PAT_DON_PETRY |
.github/workflows/dev-lead-reusable.yml |
Repoints all Copilot token reads and the preflight GH_PAT passthrough to secrets.GH_PAT_DON_PETRY, and removes obsolete reusable secret declarations. |
|
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
Superseded by automated re-review at
|
…#1327) The collapse removed pr-review.yml's COPILOT_GITHUB_TOKEN/GH_PAT workflow_call.secrets declarations. TalkTerm/.github/workflows/pr-review.yml calls this reusable @pr-review/stable and passes those secrets BY NAME (not secrets: inherit), so once promoted to the channel it hard-fails validation — silently disabling TalkTerm's PR-review control. Caught by the pr-review cascade (MAJOR). Verified fleet-wide: every dev-lead caller and 6/7 pr-review callers use `secrets: inherit`; only TalkTerm's pr-review caller is by-name. So this fix is scoped to pr-review.yml only (dev-lead-reusable.yml / gh-aw-cross-org.yml / readme-refresh.yml are safe as-is under inherit/standalone). - Restore COPILOT_GITHUB_TOKEN and GH_PAT as optional workflow_call.secrets. - Resolve COPILOT_GITHUB_TOKEN as `GH_PAT_DON_PETRY || COPILOT_GITHUB_TOKEN || GH_PAT`: inherit callers get the collapse; by-name callers (TalkTerm) keep working. Zero regression. - Correct machine-user-setup.md: GH_PAT is retained as a transitional by-name fallback (not yet retired) until TalkTerm migrates to `secrets: inherit`. Full removal + GH_PAT deletion is deferred to the caller-migration follow-up. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: e2430557e6dd3cec2bf6d7e9f864af903f26497b
Review mode: triage-approved (single reviewer)
Summary
Re-review after the prior cascade's fix-requested cycle. The fix commit resolves the sole MAJOR blocker exactly as prescribed: pr-review.yml restores COPILOT_GITHUB_TOKEN and GH_PAT as optional workflow_call.secrets declarations (honoring issue #1327's safety gate for TalkTerm's by-name caller) and resolves the Copilot token as GH_PAT_DON_PETRY || COPILOT_GITHUB_TOKEN || GH_PAT, so inherit callers get the collapse while TalkTerm keeps working. The prior MINOR (TalkTerm's token resolving empty) is closed by the same fallback chain. The consolidation itself introduces no new privilege exposure — the Copilot engine was already running on the same don-petry classic PAT via the || secrets.GH_PAT fallback — and no secret material appears in the diff. Docs (machine-user-setup.md, spec.md, AGENTS.md) updated to match.
Linked issue analysis
Closes #1327 (Collapse GH_PAT_DON_PETRY_COPILOT → GH_PAT_DON_PETRY). All three scope items are substantively addressed: (1) every Copilot token path repointed to secrets.GH_PAT_DON_PETRY, preserving the || secrets.GITHUB_TOKEN leg in gh-aw-cross-org.yml and adding no GH_PAT fallback outside pr-review.yml; (2) dead declarations removed from dev-lead-reusable.yml (all dev-lead callers verified on secrets: inherit), while pr-review.yml retains them per the issue's explicit safety gate because TalkTerm passes them by name; (3) docs updated. Out-of-scope items (#1326 secret deletion) correctly untouched.
Findings
- RESOLVED (was MAJOR): pr-review.yml workflow_call.secrets declarations for COPILOT_GITHUB_TOKEN/GH_PAT restored; TalkTerm's by-name caller will pass validation once promoted to pr-review/stable.
- RESOLVED (was MINOR): COPILOT_GITHUB_TOKEN now falls back to the by-name secrets, so TalkTerm's Copilot engine keeps authenticating until it migrates to secrets: inherit.
- INFO (carried, non-blocking): same-value assertion for GH_PAT vs GH_PAT_DON_PETRY remains the owner's claim, accepted per issue #1327; stale stub header comments deferred to the next freeze-protected stub-template refresh.
- No new issues introduced by the fix commit (scoped to pr-review.yml + machine-user-setup.md). The single gemini-code-assist review thread is resolved. Secret-scan MCP tool unavailable in this run; gitleaks CI check passed.
CI status
All checks green at e243055: Lint, actionlint, ShellCheck, CodeQL (actions+python), gitleaks secret scan, AgentShield, SonarCloud quality gate, caller-stub-freeze, validate-caller-inputs, caller-permissions, verify-persona-identity, gh-aw-compile, unit tests/bats. Dependabot/audit jobs skipped (not applicable).
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Closes #1327
Implemented by dev-lead agent. Please review.