Skip to content

ci: use built-in token for team-memory queue - #1943

Merged
Changyong Gong (chagong) merged 1 commit into
mainfrom
chagong-test-runner-built-in-token
Oct 12, 2026
Merged

Changyong Gong (chagong) merged 1 commit into
mainfrom
chagong-test-runner-built-in-token

Conversation

@chagong

Copy link
Copy Markdown
Contributor

DRAFT — cross-repository authorization blocker; not merge-ready. The built-in github.token here is scoped to microsoft/vscode-java-test and has no Actions-write access to microsoft/vscode-java-pack, the explicitly preserved coordinator target. Job-level actions: write only grants permission within the caller repository; it does not authorize cross-repository workflow_dispatch. The Java Pack reference dispatches within its own repository, and the public-source READ diagnostic does not prove cross-repository writes. This requested substitution is therefore not a proven working replacement for the coordinator-scoped App token. Do not merge this draft without resolving that authorization blocker.

Exact request

I need you to create PRs for all the rest java tooling repos, refer to team-memory-post-merge.yml in vscode-java-pack, remove the step of getting dispatch token

Change

Based on current main (after merged #1941), this PR changes only .github/workflows/team-memory-post-merge.yml: removes the actions/create-github-app-token dispatch-token step, replaces ${{ steps.dispatch-token.outputs.token }} with ${{ github.token }}, and adds job permissions contents: read / actions: write, matching the current Java Pack own-source workflow while preserving top-level permissions: {}.

All existing opt-in, canonical-source, default-main-push, workflow-head, non-created, non-deleted, and non-forced gates and concurrency remain unchanged. The immutable queue action pin, explicit Java Pack repository / coordinator workflow / main ref, and exact five string JSON inputs remain unchanged. No public documentation, policy, extension, coordinator, credentials, settings, or architecture changes.

Validation and operational limits

Session-local offline YAML 1.2 parsing, structural and exact semantic-diff checks, permission/reference checks, all eight gates, main-only trigger, immutable pin, fixed coordinator target/workflow/ref, exact five-string JSON payload, absence of dangling token/credential references, workflow-only scope, and git diff --check passed. No validation tooling was added to the repository.

No live token mint, workflow dispatch/rerun, Azure/IssueLens/wiki invocation, deployment, or secrets/vars/App/settings changes were performed. Offline checks do not establish live cross-repository dispatch authorization. Production remains unchanged; this PR is draft-only, with no merge or auto-merge requested.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@wenytang-ms
wenyt (wenytang-ms) marked this pull request as ready for review October 12, 2026 02:42
@chagong
Changyong Gong (chagong) merged commit ebdddcf into main Oct 12, 2026
6 checks passed
Changyong Gong (chagong) added a commit that referenced this pull request Oct 12, 2026
This reverts commit ebdddcf (#1943). Restore the Java Pack-scoped App token because the source GITHUB_TOKEN cannot dispatch workflows across repositories.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants