Repository navigation
ci: use built-in token for team-memory queue - #1943
Merged
Changyong Gong (chagong) merged 1 commit intoOct 12, 2026
Merged
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
wenyt (wenytang-ms)
marked this pull request as ready for review
October 12, 2026 02:42
wenyt (wenytang-ms)
approved these changes
Oct 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DRAFT — cross-repository authorization blocker; not merge-ready. The built-in
github.tokenhere is scoped tomicrosoft/vscode-java-testand has no Actions-write access tomicrosoft/vscode-java-pack, the explicitly preserved coordinator target. Job-levelactions: writeonly grants permission within the caller repository; it does not authorize cross-repositoryworkflow_dispatch. The Java Pack reference dispatches within its own repository, and the public-source READ diagnostic does not prove cross-repository writes. This requested substitution is therefore not a proven working replacement for the coordinator-scoped App token. Do not merge this draft without resolving that authorization blocker.Exact request
Change
Based on current
main(after merged #1941), this PR changes only.github/workflows/team-memory-post-merge.yml: removes theactions/create-github-app-tokendispatch-token step, replaces${{ steps.dispatch-token.outputs.token }}with${{ github.token }}, and adds job permissionscontents: read/actions: write, matching the current Java Pack own-source workflow while preserving top-levelpermissions: {}.All existing opt-in, canonical-source, default-main-push, workflow-head, non-created, non-deleted, and non-forced gates and concurrency remain unchanged. The immutable queue action pin, explicit Java Pack repository / coordinator workflow / main ref, and exact five string JSON inputs remain unchanged. No public documentation, policy, extension, coordinator, credentials, settings, or architecture changes.
Validation and operational limits
Session-local offline YAML 1.2 parsing, structural and exact semantic-diff checks, permission/reference checks, all eight gates, main-only trigger, immutable pin, fixed coordinator target/workflow/ref, exact five-string JSON payload, absence of dangling token/credential references, workflow-only scope, and
git diff --checkpassed. No validation tooling was added to the repository.No live token mint, workflow dispatch/rerun, Azure/IssueLens/wiki invocation, deployment, or secrets/vars/App/settings changes were performed. Offline checks do not establish live cross-repository dispatch authorization. Production remains unchanged; this PR is draft-only, with no merge or auto-merge requested.