From 5ca6d6b7977c19ff7491f91266557f94071420c3 Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Sun, 28 Jun 2026 20:24:19 +0200 Subject: [PATCH] ci: use CODEX_FIXER_TOKEN for bot PR auto-merge (secret CHACK_AGENT_FIXER_TOKEN never existed) The workflows referenced a secret (CHACK_AGENT_FIXER_TOKEN) that does not exist in the repo, so it resolved to empty and the windows-definitions auto-merge could neither dispatch PR-tests nor merge. Point every reference at the existing CODEX_FIXER_TOKEN PAT (fine-grained, admin on the repo) instead. Remove the temporary token probe. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/chack-agent-pr-triage.yml | 6 +-- .../ci-master-failure-chack-agent-pr.yml | 6 +-- .../pr-failure-chack-agent-dispatch.yml | 2 +- .../update_windows_version_definitions.yml | 4 +- .github/workflows/zz-token-probe.yml | 39 ------------------- 5 files changed, 9 insertions(+), 48 deletions(-) delete mode 100644 .github/workflows/zz-token-probe.yml diff --git a/.github/workflows/chack-agent-pr-triage.yml b/.github/workflows/chack-agent-pr-triage.yml index c3c7299..652dde2 100644 --- a/.github/workflows/chack-agent-pr-triage.yml +++ b/.github/workflows/chack-agent-pr-triage.yml @@ -102,12 +102,12 @@ jobs: - name: Merge trusted bot PR if: ${{ steps.bot_pr.outputs.should_merge == 'true' }} env: - GH_TOKEN: ${{ secrets.CHACK_AGENT_FIXER_TOKEN }} + GH_TOKEN: ${{ secrets.CODEX_FIXER_TOKEN }} PR_NUMBER: ${{ steps.bot_pr.outputs.pr_number }} COMMIT_TITLE: ${{ steps.bot_pr.outputs.title }} run: | if [ -z "$GH_TOKEN" ]; then - echo "CHACK_AGENT_FIXER_TOKEN is required to merge this PR and dispatch the release workflow." + echo "CODEX_FIXER_TOKEN is required to merge this PR and dispatch the release workflow." exit 1 fi @@ -120,7 +120,7 @@ jobs: -f commit_title="$COMMIT_TITLE")"; then merge_sha="$(jq -r '.sha // empty' <<<"$response")" echo "Merged trusted windows definitions bot PR #$PR_NUMBER as $merge_sha." - # The squash-merge is performed with CHACK_AGENT_FIXER_TOKEN (a PAT, not + # The squash-merge is performed with CODEX_FIXER_TOKEN (a PAT, not # GITHUB_TOKEN), so the resulting push to master triggers CI-master_test via its # `push` trigger, which builds and publishes the PEASS release. We intentionally # do NOT also dispatch CI-master_test here, to avoid publishing two releases for diff --git a/.github/workflows/ci-master-failure-chack-agent-pr.yml b/.github/workflows/ci-master-failure-chack-agent-pr.yml index b9bf7bc..25a6f2b 100644 --- a/.github/workflows/ci-master-failure-chack-agent-pr.yml +++ b/.github/workflows/ci-master-failure-chack-agent-pr.yml @@ -21,7 +21,7 @@ jobs: TARGET_BRANCH: master FIX_BRANCH: chack-agent/ci-master-fix-${{ github.event.workflow_run.id }} CHACK_LOGS_HTTP_URL: ${{ secrets.CHACK_LOGS_HTTP_URL }} - CAN_PUSH_WORKFLOWS: ${{ secrets.CHACK_AGENT_FIXER_TOKEN != '' }} + CAN_PUSH_WORKFLOWS: ${{ secrets.CODEX_FIXER_TOKEN != '' }} steps: - name: Checkout failing commit uses: actions/checkout@v5 @@ -29,7 +29,7 @@ jobs: ref: ${{ github.event.workflow_run.head_sha }} fetch-depth: 0 persist-credentials: true - token: ${{ secrets.CHACK_AGENT_FIXER_TOKEN || github.token }} + token: ${{ secrets.CODEX_FIXER_TOKEN || github.token }} - name: Configure git author run: | @@ -300,7 +300,7 @@ jobs: if: ${{ steps.push_fix.outputs.pushed == 'true' }} id: create_pr env: - GH_TOKEN: ${{ secrets.CHACK_AGENT_FIXER_TOKEN || github.token }} + GH_TOKEN: ${{ secrets.CODEX_FIXER_TOKEN || github.token }} RUN_URL: ${{ github.event.workflow_run.html_url }} run: | set +e diff --git a/.github/workflows/pr-failure-chack-agent-dispatch.yml b/.github/workflows/pr-failure-chack-agent-dispatch.yml index 8cd7894..172232a 100644 --- a/.github/workflows/pr-failure-chack-agent-dispatch.yml +++ b/.github/workflows/pr-failure-chack-agent-dispatch.yml @@ -114,7 +114,7 @@ jobs: ref: ${{ github.event.workflow_run.head_sha }} fetch-depth: 0 persist-credentials: true - token: ${{ secrets.CHACK_AGENT_FIXER_TOKEN || github.token }} + token: ${{ secrets.CODEX_FIXER_TOKEN || github.token }} - name: Configure git author run: | diff --git a/.github/workflows/update_windows_version_definitions.yml b/.github/workflows/update_windows_version_definitions.yml index 6a54fba..4a9bf10 100644 --- a/.github/workflows/update_windows_version_definitions.yml +++ b/.github/workflows/update_windows_version_definitions.yml @@ -39,7 +39,7 @@ jobs: - name: Create validated update pull request env: GH_TOKEN: ${{ github.token }} - PR_TESTS_DISPATCH_TOKEN: ${{ secrets.CHACK_AGENT_FIXER_TOKEN }} + PR_TESTS_DISPATCH_TOKEN: ${{ secrets.CODEX_FIXER_TOKEN }} run: | title="chore(winpeas): update windows version vulnerability definitions" branch="bot/update-windows-version-definitions" @@ -81,7 +81,7 @@ jobs: # job. Dispatching with a PAT makes the run user-owned, so `workflow_run` fires and # the trusted merge job runs once PR-tests pass. if [ -z "$PR_TESTS_DISPATCH_TOKEN" ]; then - echo "CHACK_AGENT_FIXER_TOKEN is required to dispatch PR-tests so the auto-merge workflow_run event fires." + echo "CODEX_FIXER_TOKEN is required to dispatch PR-tests so the auto-merge workflow_run event fires." exit 1 fi diff --git a/.github/workflows/zz-token-probe.yml b/.github/workflows/zz-token-probe.yml deleted file mode 100644 index 40cffcb..0000000 --- a/.github/workflows/zz-token-probe.yml +++ /dev/null @@ -1,39 +0,0 @@ -name: zz-token-probe - -on: - workflow_dispatch: - -jobs: - probe: - runs-on: ubuntu-latest - steps: - - name: Probe candidate tokens - env: - CODEX_FIXER_TOKEN: ${{ secrets.CODEX_FIXER_TOKEN }} - PULL_REQUEST_TOKEN: ${{ secrets.PULL_REQUEST_TOKEN }} - CODEX_ACCESS_TOKEN: ${{ secrets.CODEX_ACCESS_TOKEN }} - CHACK_AGENT_FIXER_TOKEN: ${{ secrets.CHACK_AGENT_FIXER_TOKEN }} - run: | - probe() { - local name="$1" tok="$2" - echo "==================================================" - echo "TOKEN: $name" - if [ -z "$tok" ]; then - echo " state: EMPTY / not set" - return - fi - echo " state: present (len=${#tok})" - # Identity + classic scopes (header is only present for classic PATs) - hdrs="$(curl -sS -D - -o /tmp/body.json -H "Authorization: token $tok" https://api.github.com/user)" - login="$(jq -r '.login // "?"' /tmp/body.json 2>/dev/null)" - echo " login: $login" - echo " x-oauth-scopes: $(printf '%s' "$hdrs" | tr -d '\r' | awk -F': ' 'tolower($1)=="x-oauth-scopes"{print $2}')" - # Repo permission for this token on PEASS-ng - perm="$(curl -sS -H "Authorization: token $tok" https://api.github.com/repos/peass-ng/PEASS-ng | jq -r '.permissions // {}' 2>/dev/null)" - echo " repo permissions: $perm" - } - probe CODEX_FIXER_TOKEN "$CODEX_FIXER_TOKEN" - probe PULL_REQUEST_TOKEN "$PULL_REQUEST_TOKEN" - probe CODEX_ACCESS_TOKEN "$CODEX_ACCESS_TOKEN" - probe CHACK_AGENT_FIXER_TOKEN "$CHACK_AGENT_FIXER_TOKEN" - echo "=================================================="