fix(provisioner): explicit GH_TOKEN/GITHUB_TOKEN win over GH_PAT alias (#1687)

The GH_PAT alias was appended unconditionally after the env loop, so
explicit GH_TOKEN or GITHUB_TOKEN values in workspace secrets were
being overridden despite the PR contract saying "explicit values win".

Fix: track explicit GH_TOKEN / GITHUB_TOKEN while iterating cfg.EnvVars,
preserve them instead of dropping them via the SCM-write guard, and
only apply the GH_PAT alias for keys that were not explicitly set.

Adds TestBuildContainerEnv_GHPATAliasPrecedence with 5 sub-tests:
- GH_PAT alone → alias both
- explicit GH_TOKEN wins
- explicit GITHUB_TOKEN wins
- explicit both → both preserved, no alias
- no GH_PAT → no alias injected

Closes review_id=5646 (CR2 blocker).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

workspace-server/internal/provisioner/provisioner.go

@@ -710,7 +710,19 @@ func buildContainerEnv(cfg WorkspaceConfig) []string {
 		env = append(env, fmt.Sprintf("AWARENESS_NAMESPACE=%s", cfg.AwarenessNamespace))
 		env = append(env, fmt.Sprintf("AWARENESS_URL=%s", cfg.AwarenessURL))
 	}
+	// #1687: track explicit GH_TOKEN / GITHUB_TOKEN so they win over GH_PAT
+	// alias. These are normally stripped by the SCM-write guard below, but
+	// when a user explicitly sets them we preserve the value.
+	var explicitGHToken, explicitGitHubToken string
 	for k, v := range cfg.EnvVars {
+		if k == "GH_TOKEN" {
+			explicitGHToken = v
+			continue
+		}
+		if k == "GITHUB_TOKEN" {
+			explicitGitHubToken = v
+			continue
+		}
 		// Forensic #145 hardening: tenant workspace containers run
 		// agent-controlled code and must NEVER receive a Git SCM *write*
 		// credential. Without merge/approve creds in-container the
@@ -729,13 +741,16 @@ func buildContainerEnv(cfg WorkspaceConfig) []string {
 		env = append(env, fmt.Sprintf("%s=%s", k, v))
 	}
 	// #1687: alias GH_PAT → GH_TOKEN / GITHUB_TOKEN on the READ side
-	// (container env assembly). gh CLI and git credential helpers look
-	// for these standard names; by aliasing here we avoid writing the
-	// forbidden keys into tenant-writer surfaces (workspace_secrets,
-	// envVars map, etc.). GH_PAT itself is not an SCM-write credential
-	// and passes through cfg.EnvVars untouched.
-	if pat, hasPAT := cfg.EnvVars["GH_PAT"]; hasPAT && pat != "" {
+	// (container env assembly). Explicit values win: only alias when the
+	// key was not set in workspace secrets.
+	if explicitGHToken != "" {
+		env = append(env, fmt.Sprintf("GH_TOKEN=%s", explicitGHToken))
+	} else if pat, hasPAT := cfg.EnvVars["GH_PAT"]; hasPAT && pat != "" {
 		env = append(env, fmt.Sprintf("GH_TOKEN=%s", pat))
+	}
+	if explicitGitHubToken != "" {
+		env = append(env, fmt.Sprintf("GITHUB_TOKEN=%s", explicitGitHubToken))
+	} else if pat, hasPAT := cfg.EnvVars["GH_PAT"]; hasPAT && pat != "" {
 		env = append(env, fmt.Sprintf("GITHUB_TOKEN=%s", pat))
 	}
 	// Inject ADMIN_TOKEN from the platform server's environment so workspace

workspace-server/internal/provisioner/provisioner_test.go

@@ -855,6 +855,106 @@ func TestCPProvisionerEnv_StripsSCMWriteTokens(t *testing.T) {
 	}
 }
 
+// TestBuildContainerEnv_GHPATAliasPrecedence asserts that explicit GH_TOKEN /
+// GITHUB_TOKEN in workspace secrets win over the GH_PAT alias (#1687 CR2
+// review_id=5646). The alias must only inject a key when it was NOT explicitly
+// set.
+func TestBuildContainerEnv_GHPATAliasPrecedence(t *testing.T) {
+	pat := "ghp_pat_from_secrets"
+	explicitGH := "gh_explicit_token"
+	explicitGitHub := "github_explicit_token"
+
+	t.Run("GH_PAT alone → alias both", func(t *testing.T) {
+		cfg := WorkspaceConfig{
+			WorkspaceID: "ws-x",
+			PlatformURL: "http://localhost:8080",
+			EnvVars:     map[string]string{"GH_PAT": pat},
+		}
+		env := buildContainerEnv(cfg)
+		if !envContains(env, "GH_TOKEN="+pat) {
+			t.Errorf("GH_PAT alias must set GH_TOKEN, got %v", env)
+		}
+		if !envContains(env, "GITHUB_TOKEN="+pat) {
+			t.Errorf("GH_PAT alias must set GITHUB_TOKEN, got %v", env)
+		}
+	})
+
+	t.Run("explicit GH_TOKEN wins over GH_PAT alias", func(t *testing.T) {
+		cfg := WorkspaceConfig{
+			WorkspaceID: "ws-x",
+			PlatformURL: "http://localhost:8080",
+			EnvVars: map[string]string{
+				"GH_PAT":   pat,
+				"GH_TOKEN": explicitGH,
+			},
+		}
+		env := buildContainerEnv(cfg)
+		if envContains(env, "GH_TOKEN="+pat) {
+			t.Errorf("explicit GH_TOKEN must win over GH_PAT alias, got GH_TOKEN=%q", pat)
+		}
+		if !envContains(env, "GH_TOKEN="+explicitGH) {
+			t.Errorf("explicit GH_TOKEN must be preserved, got %v", env)
+		}
+	})
+
+	t.Run("explicit GITHUB_TOKEN wins over GH_PAT alias", func(t *testing.T) {
+		cfg := WorkspaceConfig{
+			WorkspaceID: "ws-x",
+			PlatformURL: "http://localhost:8080",
+			EnvVars: map[string]string{
+				"GH_PAT":        pat,
+				"GITHUB_TOKEN": explicitGitHub,
+			},
+		}
+		env := buildContainerEnv(cfg)
+		if envContains(env, "GITHUB_TOKEN="+pat) {
+			t.Errorf("explicit GITHUB_TOKEN must win over GH_PAT alias, got GITHUB_TOKEN=%q", pat)
+		}
+		if !envContains(env, "GITHUB_TOKEN="+explicitGitHub) {
+			t.Errorf("explicit GITHUB_TOKEN must be preserved, got %v", env)
+		}
+	})
+
+	t.Run("explicit both → both preserved, no alias", func(t *testing.T) {
+		cfg := WorkspaceConfig{
+			WorkspaceID: "ws-x",
+			PlatformURL: "http://localhost:8080",
+			EnvVars: map[string]string{
+				"GH_PAT":        pat,
+				"GH_TOKEN":      explicitGH,
+				"GITHUB_TOKEN": explicitGitHub,
+			},
+		}
+		env := buildContainerEnv(cfg)
+		if envContains(env, "GH_TOKEN="+pat) {
+			t.Errorf("explicit GH_TOKEN must win, got alias value %q", pat)
+		}
+		if envContains(env, "GITHUB_TOKEN="+pat) {
+			t.Errorf("explicit GITHUB_TOKEN must win, got alias value %q", pat)
+		}
+		if !envContains(env, "GH_TOKEN="+explicitGH) {
+			t.Errorf("explicit GH_TOKEN must be preserved, got %v", env)
+		}
+		if !envContains(env, "GITHUB_TOKEN="+explicitGitHub) {
+			t.Errorf("explicit GITHUB_TOKEN must be preserved, got %v", env)
+		}
+	})
+
+	t.Run("no GH_PAT → no alias injected", func(t *testing.T) {
+		cfg := WorkspaceConfig{
+			WorkspaceID: "ws-x",
+			PlatformURL: "http://localhost:8080",
+			EnvVars:     map[string]string{"OTHER": "ok"},
+		}
+		env := buildContainerEnv(cfg)
+		for _, e := range env {
+			if strings.HasPrefix(e, "GH_TOKEN=") || strings.HasPrefix(e, "GITHUB_TOKEN=") {
+				t.Errorf("no GH_PAT present → no alias should be injected, got %q", e)
+			}
+		}
+	})
+}
+
 func assertNoSCMWriteToken(t *testing.T, env []string, scmTokens []string) {
 	t.Helper()
 	for _, e := range env {