Skip to content

[OPS-1301] Use baton-ci app token in capabilities_and_config.yaml - #147

Merged
gontzess merged 1 commit into
mainfrom
ennyfrick/ops-1301-baton-ci-migration
Apr 29, 2026
Merged

[OPS-1301] Use baton-ci app token in capabilities_and_config.yaml#147
gontzess merged 1 commit into
mainfrom
ennyfrick/ops-1301-baton-ci-migration

Conversation

@ennyjfrick

Copy link
Copy Markdown
Contributor

Replace the long-lived RELENG_GITHUB_TOKEN PAT with a short-lived baton-ci app token scoped to the current repo.

Mirrors the OPS-1300 templated workflow pattern. With the Connector Rules ruleset hardened, the legacy PAT only continues to work because of the temp org-admin mitigation; this PR replaces it with the proper App-token bypass actor before that mitigation is removed.

Linear: OPS-1301

🤖 Generated with Claude Code

Replace the long-lived RELENG_GITHUB_TOKEN PAT with a short-lived
baton-ci app token scoped to the current repo. Mirrors the OPS-1300
templated workflow pattern; needed before the temp org-admin
mitigation can safely be removed.

Linear: https://linear.app/ductone/issue/OPS-1301

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@ennyjfrick
ennyjfrick requested a review from a team April 29, 2026 14:52
@linear

linear Bot commented Apr 29, 2026

Copy link
Copy Markdown

@github-actions

github-actions Bot commented Apr 29, 2026

Copy link
Copy Markdown
Contributor

Claude finished @ennyjfrick's task in 57s —— View job


PR Review: [OPS-1301] Use baton-ci app token in capabilities_and_config.yaml

  • Gather context and review PR diff
  • Analyze changes for correctness and security
  • Post review feedback

Summary

This PR replaces the long-lived RELENG_GITHUB_TOKEN PAT with a short-lived GitHub App token (baton-ci) in the capabilities_and_config.yaml workflow. The change is clean and follows the established pattern already used in update-dependencies.yaml.

Review

Looks good. The implementation is correct and mirrors update-dependencies.yaml exactly:

Aspect Status
Token minting step placement (before checkout) ✅ Correct
actions/create-github-app-token@v2 usage ✅ Matches existing pattern
App ID via vars.BATON_CI_CLIENT_ID ✅ Consistent
Private key via secrets.BATON_CI_SECRET_KEY ✅ Consistent
Token scoped to current repo via repositories ✅ Least privilege
Step ID reference steps.ci-token.outputs.token ✅ Correct
EndBug/add-and-commit@v9 commit step ✅ Inherits the checkout token automatically

Security improvement: The new approach replaces a long-lived org-scoped PAT with a short-lived, repo-scoped app token — a clear security win.

No issues found. The EndBug/add-and-commit action at the end of the workflow inherits the token used during checkout, so it will correctly use the app token for pushing the generated config_schema.json and baton_capabilities.json files. No additional token configuration is needed there.

Note: Two other workflows (release.yaml, verify.yaml) still reference RELENG_GITHUB_TOKEN, but those are managed by baton-admin and call reusable workflows from ConductorOne/github-workflows — they're out of scope for this PR and would need to be migrated at the template level (presumably tracked under OPS-1300).

Verdict: Approve

@gontzess
gontzess merged commit 6688085 into main Apr 29, 2026
6 of 8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants