Pull request overview

This PR hardens repository automation by introducing a reusable composite action that selects a GitHub automation credential (GitHub App installation token preferred, with a PAT fallback) and updating multiple workflows to use the selected token while logging only the chosen source.

Changes:

• Added a new composite action (.github/actions/github-app-token) to mint a GitHub App installation token via Azure Key Vault signing, with rollout modes and PAT fallback.
• Updated issue/PR automation workflows to use the action output token and added OIDC permissions/environment binding.
• Added a Node test covering token/JWT construction and the GitHub installation token request payload.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 7 comments.

Automated Code Review

Reviewers: 5 | Confidence: 93% | Result: All clear

Reviewed: Correctness, Security Reliability, Test Coverage, Failure Modes, Design Approach

Automated review by moonbox3's agents

Automated Code Review

Reviewers: 5 | Confidence: 89%

✓ Correctness

The PR introduces a well-designed reusable credential-selection action with proper fallback logic, input validation, and security measures. The token creation logic correctly handles JWT construction, Azure Key Vault signing, and installation token requests. All workflows that run on pull_request_target correctly pin their checkout to the base SHA. The test coverage validates the key code paths. No correctness issues found.

✓ Security Reliability

The PR is well-designed from a security and reliability standpoint. Credential material is properly masked before output, the composite action's fallback state machine fails closed (hard failure when no token is available and mode is not fallback-capable), pull_request_target workflows correctly pin checkouts to the base SHA, and the token creation script uses execFileSync with argument arrays to prevent shell injection. All previously identified issues in the review thread have been addressed. No new security or reliability concerns found.

✓ Test Coverage

The test file covers the happy path and input validation well, and the new CI workflow ensures tests run on PR/push. However, several error-handling branches in create-token.js lack test coverage: the Key Vault empty-signature guard, the GitHub API HTTP failure path, and the empty-token validation. These are security-relevant error paths that could silently regress without dedicated assertions.

✓ Failure Modes

The credential selection mechanism is well-structured with proper fallback logic, safe checkout pining, and input validation. The one operational concern is that the bare catch in create-token.js discards all diagnostic context from failures, making it very difficult to determine root cause when the app credential path breaks. Since execFileSync pipes (rather than inherits) child stderr, Azure CLI error messages are also invisible.

✗ Design Approach

The rollout wiring is mostly solid, but two workflows now feed the new app token into team-membership checks that still treat any GitHub API failure as "not a team member." That undermines the stated fail-safe rollout goal: a permission gap or transient org/team lookup failure would silently misclassify internal contributors instead of surfacing the rollout problem or falling back.

Flagged Issues

• In .github/workflows/devflow-pr-review.yml:99-121, the new token path can silently convert team-membership lookup failures into is_team_member=false, which skips review for internal PRs instead of failing safely during rollout.
• In .github/workflows/label-issues.yml:43 plus .github/workflows/label-issues.yml:52-70, the new token path can silently convert team-membership lookup failures into "external author," causing internal issues to be mislabeled as community triage.

Automated review by moonbox3's agents