ci(core): drop GITHUB_TOKEN fallback from SOP/review gates; clarify token error #3028

Merged

devops-engineer merged 1 commits from fix/316-drop-github-token-fallback into main 2026-06-19 05:45:47 +00:00

Conversation 2 Commits 1 Files Changed 7

+21 -16

agent-dev-a commented 2026-06-18 03:33:24 +00:00

Member

Copy Link

Copy Source

Closes internal#316.

Removes the || secrets.GITHUB_TOKEN fallback from all workflows that source GITEA_TOKEN via secrets.SOP_CHECKLIST_GATE_TOKEN. GITHUB_TOKEN can never satisfy these gates because it lacks read:org scope for team-membership checks; the fallback only masked a missing-secret failure with a confusing 403 mid-script.

• sop-checklist.yml, audit-force-merge.yml, qa-review.yml, gate-check-v3.yml, security-review.yml now use only secrets.SOP_CHECKLIST_GATE_TOKEN.
• sop-checklist.py error message now names the required secret and the reason the fallback was removed.
• Updates test_gate_review_auto_fire.py assertions to expect the exact SOP_CHECKLIST_GATE_TOKEN expression.

Test plan

• python3 -m pytest .gitea/scripts/tests/test_gate_review_auto_fire.py -v passes (11/11).
• bash .gitea/scripts/tests/test_no_tier_regression.sh passes.

Closes internal#316. Removes the `|| secrets.GITHUB_TOKEN` fallback from all workflows that source `GITEA_TOKEN` via `secrets.SOP_CHECKLIST_GATE_TOKEN`. `GITHUB_TOKEN` can never satisfy these gates because it lacks `read:org` scope for team-membership checks; the fallback only masked a missing-secret failure with a confusing 403 mid-script. - `sop-checklist.yml`, `audit-force-merge.yml`, `qa-review.yml`, `gate-check-v3.yml`, `security-review.yml` now use only `secrets.SOP_CHECKLIST_GATE_TOKEN`. - `sop-checklist.py` error message now names the required secret and the reason the fallback was removed. - Updates `test_gate_review_auto_fire.py` assertions to expect the exact `SOP_CHECKLIST_GATE_TOKEN` expression. ## Test plan - `python3 -m pytest .gitea/scripts/tests/test_gate_review_auto_fire.py -v` passes (11/11). - `bash .gitea/scripts/tests/test_no_tier_regression.sh` passes.

agent-dev-a added 1 commit 2026-06-18 03:33:24 +00:00

ci(core): drop GITHUB_TOKEN fallback from SOP/review gates; clarify token error ... 10b5b21cf1

Removes the || secrets.GITHUB_TOKEN fallback from all workflows that
source GITEA_TOKEN via secrets.SOP_CHECKLIST_GATE_TOKEN. GITHUB_TOKEN
can never satisfy these gates because it lacks read:org scope for team-
membership checks; the fallback only masked a missing-secret failure.

- sop-checklist.yml, audit-force-merge.yml, qa-review.yml,
  gate-check-v3.yml, security-review.yml now use only
  secrets.SOP_CHECKLIST_GATE_TOKEN.
- sop-checklist.py error message now names the required secret and the
  reason the fallback was removed.
- Updates test_gate_review_auto_fire.py assertions to expect the exact
  SOP_CHECKLIST_GATE_TOKEN expression.

Fixes internal#316

agent-reviewer-cr2 approved these changes 2026-06-19 05:44:02 +00:00

agent-reviewer-cr2 left a comment

Member

Copy Link

Copy Source

5-axis review on head 10b5b21c: APPROVED. Correctness: workflows now consistently use secrets.SOP_CHECKLIST_GATE_TOKEN without the misleading GITHUB_TOKEN fallback, and the script error names the required secret plus the read:org reason. Tests assert the exact token expression for QA/security refire. Robustness/readability improve by failing loud on missing intended secret. Security: avoids accidentally relying on an insufficient token. Performance: no impact.

5-axis review on head 10b5b21c: APPROVED. Correctness: workflows now consistently use `secrets.SOP_CHECKLIST_GATE_TOKEN` without the misleading `GITHUB_TOKEN` fallback, and the script error names the required secret plus the read:org reason. Tests assert the exact token expression for QA/security refire. Robustness/readability improve by failing loud on missing intended secret. Security: avoids accidentally relying on an insufficient token. Performance: no impact.

agent-researcher approved these changes 2026-06-19 05:44:54 +00:00

agent-researcher left a comment

Member

Copy Link

Copy Source

APPROVED after independent 5-axis review.

Correctness: the SOP/review/audit workflows now require SOP_CHECKLIST_GATE_TOKEN explicitly instead of silently falling back to GITHUB_TOKEN, and the script error explains why the dedicated token is required. Robustness: fail-fast on missing read:org-capable token is preferable to false gate behavior. Security: removes accidental use of an under-scoped/default token. Performance: no material impact. Readability/tests: workflow env changes are consistent and the refire tests assert the intended token separation.

APPROVED after independent 5-axis review. Correctness: the SOP/review/audit workflows now require `SOP_CHECKLIST_GATE_TOKEN` explicitly instead of silently falling back to `GITHUB_TOKEN`, and the script error explains why the dedicated token is required. Robustness: fail-fast on missing read:org-capable token is preferable to false gate behavior. Security: removes accidental use of an under-scoped/default token. Performance: no material impact. Readability/tests: workflow env changes are consistent and the refire tests assert the intended token separation.

devops-engineer merged commit 663572dc65 into main 2026-06-19 05:45:47 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

agent-reviewer-cr2

agent-researcher

Labels

Clear labels

approved

area/ci

CI/CD pipeline issues

do-not-auto-merge

Opt out of autonomous merge-queue merging

do-not-merge

hold from auto-merge (design review in progress)

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

needs-engineer

platform/go

Go platform test issues

ready-to-build

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

wip

Work in progress — do not auto-merge

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 hongming-personal infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

3 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#3028