gitea-mirror/PEASS-ng
1
0
Fork 0
mirror of https://github.com/peass-ng/PEASS-ng.git synced 2026-07-28 14:47:18 -07:00
Code Issues Packages Projects Releases Wiki Activity

ci: use CODEX_FIXER_TOKEN for bot PR auto-merge (secret CHACK_AGENT_FIXER_TOKEN never existed)

Browse Source 
The workflows referenced a secret (CHACK_AGENT_FIXER_TOKEN) that does not exist
in the repo, so it resolved to empty and the windows-definitions auto-merge could
neither dispatch PR-tests nor merge. Point every reference at the existing
CODEX_FIXER_TOKEN PAT (fine-grained, admin on the repo) instead. Remove the
temporary token probe.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Carlos Polop
2026-06-28 20:24:19 +02:00
co-authored by Claude Opus 4.8
parent dd11345f50
commit 5ca6d6b797
5 changed files with 9 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/chack-agent-pr-triage.yml
+3 -3
View File
@@ -102,12 +102,12 @@ jobs:
- name: Merge trusted bot PR
if: ${{ steps.bot_pr.outputs.should_merge == 'true' }}
env:
GH_TOKEN: ${{ secrets.CHACK_AGENT_FIXER_TOKEN }}
GH_TOKEN: ${{ secrets.CODEX_FIXER_TOKEN }}
PR_NUMBER: ${{ steps.bot_pr.outputs.pr_number }}
COMMIT_TITLE: ${{ steps.bot_pr.outputs.title }}
run: |
if [ -z "$GH_TOKEN" ]; then
echo "CHACK_AGENT_FIXER_TOKEN is required to merge this PR and dispatch the release workflow."
echo "CODEX_FIXER_TOKEN is required to merge this PR and dispatch the release workflow."
exit 1
fi
@@ -120,7 +120,7 @@ jobs:
-f commit_title="$COMMIT_TITLE")"; then
merge_sha="$(jq -r '.sha // empty' <<<"$response")"
echo "Merged trusted windows definitions bot PR #$PR_NUMBER as $merge_sha."
# The squash-merge is performed with CHACK_AGENT_FIXER_TOKEN (a PAT, not
# The squash-merge is performed with CODEX_FIXER_TOKEN (a PAT, not
# GITHUB_TOKEN), so the resulting push to master triggers CI-master_test via its
# `push` trigger, which builds and publishes the PEASS release. We intentionally
# do NOT also dispatch CI-master_test here, to avoid publishing two releases for
.github/workflows/ci-master-failure-chack-agent-pr.yml
+3 -3
View File
@@ -21,7 +21,7 @@ jobs:
TARGET_BRANCH: master
FIX_BRANCH: chack-agent/ci-master-fix-${{ github.event.workflow_run.id }}
CHACK_LOGS_HTTP_URL: ${{ secrets.CHACK_LOGS_HTTP_URL }}
CAN_PUSH_WORKFLOWS: ${{ secrets.CHACK_AGENT_FIXER_TOKEN != '' }}
CAN_PUSH_WORKFLOWS: ${{ secrets.CODEX_FIXER_TOKEN != '' }}
steps:
- name: Checkout failing commit
uses: actions/checkout@v5
@@ -29,7 +29,7 @@ jobs:
ref: ${{ github.event.workflow_run.head_sha }}
fetch-depth: 0
persist-credentials: true
token: ${{ secrets.CHACK_AGENT_FIXER_TOKEN || github.token }}
token: ${{ secrets.CODEX_FIXER_TOKEN || github.token }}
- name: Configure git author
run: |
@@ -300,7 +300,7 @@ jobs:
if: ${{ steps.push_fix.outputs.pushed == 'true' }}
id: create_pr
env:
GH_TOKEN: ${{ secrets.CHACK_AGENT_FIXER_TOKEN || github.token }}
GH_TOKEN: ${{ secrets.CODEX_FIXER_TOKEN || github.token }}
RUN_URL: ${{ github.event.workflow_run.html_url }}
run: |
set +e
.github/workflows/pr-failure-chack-agent-dispatch.yml
+1 -1
View File
@@ -114,7 +114,7 @@ jobs:
ref: ${{ github.event.workflow_run.head_sha }}
fetch-depth: 0
persist-credentials: true
token: ${{ secrets.CHACK_AGENT_FIXER_TOKEN || github.token }}
token: ${{ secrets.CODEX_FIXER_TOKEN || github.token }}
- name: Configure git author
run: |
.github/workflows/update_windows_version_definitions.yml
+2 -2
View File
@@ -39,7 +39,7 @@ jobs:
- name: Create validated update pull request
env:
GH_TOKEN: ${{ github.token }}
PR_TESTS_DISPATCH_TOKEN: ${{ secrets.CHACK_AGENT_FIXER_TOKEN }}
PR_TESTS_DISPATCH_TOKEN: ${{ secrets.CODEX_FIXER_TOKEN }}
run: |
title="chore(winpeas): update windows version vulnerability definitions"
branch="bot/update-windows-version-definitions"
@@ -81,7 +81,7 @@ jobs:
# job. Dispatching with a PAT makes the run user-owned, so `workflow_run` fires and
# the trusted merge job runs once PR-tests pass.
if [ -z "$PR_TESTS_DISPATCH_TOKEN" ]; then
echo "CHACK_AGENT_FIXER_TOKEN is required to dispatch PR-tests so the auto-merge workflow_run event fires."
echo "CODEX_FIXER_TOKEN is required to dispatch PR-tests so the auto-merge workflow_run event fires."
exit 1
fi
.github/workflows/zz-token-probe.yml
-39
View File
@@ -1,39 +0,0 @@
name: zz-token-probe
on:
workflow_dispatch:
jobs:
probe:
runs-on: ubuntu-latest
steps:
- name: Probe candidate tokens
env:
CODEX_FIXER_TOKEN: ${{ secrets.CODEX_FIXER_TOKEN }}
PULL_REQUEST_TOKEN: ${{ secrets.PULL_REQUEST_TOKEN }}
CODEX_ACCESS_TOKEN: ${{ secrets.CODEX_ACCESS_TOKEN }}
CHACK_AGENT_FIXER_TOKEN: ${{ secrets.CHACK_AGENT_FIXER_TOKEN }}
run: |
probe() {
local name="$1" tok="$2"
echo "=================================================="
echo "TOKEN: $name"
if [ -z "$tok" ]; then
echo " state: EMPTY / not set"
return
fi
echo " state: present (len=${#tok})"
# Identity + classic scopes (header is only present for classic PATs)
hdrs="$(curl -sS -D - -o /tmp/body.json -H "Authorization: token $tok" https://api.github.com/user)"
login="$(jq -r '.login // "?"' /tmp/body.json 2>/dev/null)"
echo " login: $login"
echo " x-oauth-scopes: $(printf '%s' "$hdrs" | tr -d '\r' | awk -F': ' 'tolower($1)=="x-oauth-scopes"{print $2}')"
# Repo permission for this token on PEASS-ng
perm="$(curl -sS -H "Authorization: token $tok" https://api.github.com/repos/peass-ng/PEASS-ng | jq -r '.permissions // {}' 2>/dev/null)"
echo " repo permissions: $perm"
}
probe CODEX_FIXER_TOKEN "$CODEX_FIXER_TOKEN"
probe PULL_REQUEST_TOKEN "$PULL_REQUEST_TOKEN"
probe CODEX_ACCESS_TOKEN "$CODEX_ACCESS_TOKEN"
probe CHACK_AGENT_FIXER_TOKEN "$CHACK_AGENT_FIXER_TOKEN"
echo "=================================================="