build: clean-up workflows

---
type: pre_commit_static_analysis_report
description: Results of running static analysis checks when committing changes.
report:
  - task: lint_filenames
    status: passed
  - task: lint_editorconfig
    status: passed
  - task: lint_markdown
    status: na
  - task: lint_package_json
    status: na
  - task: lint_repl_help
    status: na
  - task: lint_javascript_src
    status: na
  - task: lint_javascript_cli
    status: na
  - task: lint_javascript_examples
    status: na
  - task: lint_javascript_tests
    status: na
  - task: lint_javascript_benchmarks
    status: na
  - task: lint_python
    status: na
  - task: lint_r
    status: na
  - task: lint_c_src
    status: na
  - task: lint_c_examples
    status: na
  - task: lint_c_benchmarks
    status: na
  - task: lint_c_tests_fixtures
    status: na
  - task: lint_shell
    status: na
  - task: lint_typescript_declarations
    status: na
  - task: lint_typescript_tests
    status: na
  - task: lint_license_headers
    status: passed
---

---
type: pre_push_report
description: Results of running various checks prior to pushing changes.
report:
  - task: run_javascript_examples
    status: na
  - task: run_c_examples
    status: na
  - task: run_cpp_examples
    status: na
  - task: run_javascript_readme_examples
    status: na
  - task: run_c_benchmarks
    status: na
  - task: run_cpp_benchmarks
    status: na
  - task: run_fortran_benchmarks
    status: na
  - task: run_javascript_benchmarks
    status: na
  - task: run_julia_benchmarks
    status: na
  - task: run_python_benchmarks
    status: na
  - task: run_r_benchmarks
    status: na
  - task: run_javascript_tests
    status: na
---

Author: Planeshifter

.github/workflows/check_required_files.yml

@@ -73,12 +73,14 @@ jobs:
       # Get list of added files:
       - name: 'Get list of added files'
         id: added-files
+        env:
+          GITHUB_TOKEN: ${{ secrets.STDLIB_BOT_GITHUB_TOKEN }}
+          PR_NUMBER: ${{ inputs.pull_request_number }}
         run: |
           page=1
           files=""
           while true; do
-              new_files=$(curl -s -H "Accept: application/vnd.github.v3+json" -H "Authorization: Bearer ${{ secrets.STDLIB_BOT_GITHUB_TOKEN
-                 }}" "https://api.github.com/repos/stdlib-js/stdlib/pulls/${{ inputs.pull_request_number }}/files?page=$page&per_page=100" | jq -r '.[] | select(.status == "added") | .filename')
+              new_files=$(curl -s -H "Accept: application/vnd.github.v3+json" -H "Authorization: Bearer $GITHUB_TOKEN" "https://api.github.com/repos/stdlib-js/stdlib/pulls/$PR_NUMBER/files?page=$page&per_page=100" | jq -r '.[] | select(.status == "added") | .filename')
               if [ -z "$new_files" ]; then
                   break
               fi

.github/workflows/cleanup_coverage.yml

@@ -43,7 +43,7 @@ jobs:
       # Delete the 'pr-<number>' branch from the 'stdlib-js/www-test-code-coverage' repository:
       - name: 'Delete coverage branch for PR'
         env:
-          REPO_GITHUB_TOKEN: ${{ secrets.REPO_GITHUB_TOKEN }}
+          REPO_GITHUB_TOKEN: ${{ secrets.STDLIB_BOT_PAT_REPO_WRITE }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
           curl -X DELETE -H "Authorization: token $REPO_GITHUB_TOKEN" \
@@ -55,7 +55,7 @@ jobs:
         # Pin action to full length commit SHA
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
-          github-token: ${{ secrets.CHATBOT_GITHUB_TOKEN }}
+          github-token: ${{ secrets.STDLIB_BOT_PAT_REPO_WRITE }}
           script: |
             const prNumber = context.payload.pull_request.number;
             const { data: comments } = await github.rest.issues.listComments({

.github/workflows/deprecate_packages.yml

@@ -61,7 +61,7 @@ jobs:
       # Deprecate the specified packages on npm and the respective GitHub repositories:
       - name: 'Deprecate packages'
         env:
-          GITHUB_TOKEN: ${{ secrets.REPO_GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.STDLIB_BOT_PAT_REPO_WRITE }}
         run: |
           pkgs='${{ github.event.inputs.packages }}'
           npm_names=""

.github/workflows/git_note_amend_message.yml

@@ -52,9 +52,6 @@ on:
       STDLIB_BOT_GITHUB_TOKEN:
         description: 'GitHub token for stdlib-bot'
         required: true
-      REPO_GITHUB_TOKEN:
-        description: 'GitHub token for accessing the repository'
-        required: true
       STDLIB_BOT_GPG_PRIVATE_KEY:
         description: 'GPG private key for stdlib-bot'
         required: true
@@ -85,7 +82,10 @@ jobs:
           fetch-depth: 0
 
           # Token for accessing the repository:
-          token: ${{ secrets.REPO_GITHUB_TOKEN }}
+          token: ${{ secrets.STDLIB_BOT_GITHUB_TOKEN }}
+
+          # Avoid storing GitHub token in local Git configuration:
+          persist-credentials: false
 
       # Verify commit exists:
       - name: 'Verify commit exists'
@@ -130,7 +130,7 @@ jobs:
       # Commit and push changes:
       - name: 'Commit and push changes'
         env:
-            REPO_GITHUB_TOKEN: ${{ secrets.REPO_GITHUB_TOKEN }}
+            REPO_GITHUB_TOKEN: ${{ secrets.STDLIB_BOT_GITHUB_TOKEN }}
             USER_NAME: stdlib-bot
         run: |
           git config --local user.email "[email protected]"

.github/workflows/git_note_filter_packages.yml

@@ -52,9 +52,6 @@ on:
       STDLIB_BOT_GITHUB_TOKEN:
         description: 'GitHub token for stdlib-bot'
         required: true
-      REPO_GITHUB_TOKEN:
-        description: 'GitHub token for accessing the repository'
-        required: true
       STDLIB_BOT_GPG_PRIVATE_KEY:
         description: 'GPG private key for stdlib-bot'
         required: true
@@ -85,7 +82,10 @@ jobs:
           fetch-depth: 0
 
           # Token for accessing the repository:
-          token: ${{ secrets.REPO_GITHUB_TOKEN }}
+          token: ${{ secrets.STDLIB_BOT_GITHUB_TOKEN }}
+
+          # Avoid storing GitHub token in local Git configuration:
+          persist-credentials: false
 
       # Verify commit exists:
       - name: 'Verify commit exists'
@@ -139,7 +139,7 @@ jobs:
       # Commit and push changes:
       - name: 'Commit and push changes'
         env:
-            REPO_GITHUB_TOKEN: ${{ secrets.REPO_GITHUB_TOKEN }}
+            REPO_GITHUB_TOKEN: ${{ secrets.STDLIB_BOT_GITHUB_TOKEN }}
             USER_NAME: stdlib-bot
         run: |
           git config --local user.email "[email protected]"

.github/workflows/good_first_issue.yml

@@ -52,7 +52,7 @@ jobs:
       - name: 'Add comment'
         run: gh issue comment "$NUMBER" --body "$BODY"
         env:
-          GH_TOKEN: ${{ secrets.STDLIB_BOT_GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.STDLIB_BOT_FGPAT_PR_WRITE }}
           GH_REPO: ${{ github.repository }}
           NUMBER: ${{ github.event.issue.number }}
           BODY: |

.github/workflows/label_commands.yml

@@ -52,7 +52,7 @@ jobs:
         # Pin action to full length commit SHA
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
-          github-token: ${{ secrets.STDLIB_BOT_GITHUB_TOKEN }}
+          github-token: ${{ secrets.STDLIB_BOT_PAT_REPO_WRITE }}
           script: |
             try {
               await github.rest.issues.removeLabel({
@@ -69,7 +69,7 @@ jobs:
         # Pin action to full length commit SHA
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
-          github-token: ${{ secrets.STDLIB_BOT_GITHUB_TOKEN }}
+          github-token: ${{ secrets.STDLIB_BOT_PAT_REPO_WRITE }}
           script: |
             github.rest.issues.addLabels({
               'owner': context.repo.owner,
@@ -83,7 +83,7 @@ jobs:
         run: |
           curl -X POST \
             -H "Accept: application/vnd.github.v3+json" \
-            -H "Authorization: Bearer ${{ secrets.STDLIB_BOT_GITHUB_TOKEN }}" \
+            -H "Authorization: Bearer ${{ secrets.STDLIB_BOT_PAT_REPO_WRITE }}" \
             "https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/reactions" \
             -d '{"content":"eyes"}'
 
@@ -106,7 +106,7 @@ jobs:
       pull_request_number: ${{ github.event.pull_request.number }}
       user: ${{ github.event.sender.login }}
     secrets:
-      STDLIB_BOT_GITHUB_TOKEN: ${{ secrets.STDLIB_BOT_GITHUB_TOKEN }}
+      STDLIB_BOT_GITHUB_TOKEN: ${{ secrets.STDLIB_BOT_PAT_REPO_WRITE }}
 
   # Define a job for updating copyright header years:
   update_copyright_years:
@@ -126,8 +126,7 @@ jobs:
     with:
       pull_request_number: ${{ github.event.pull_request.number }}
     secrets:
-      REPO_GITHUB_TOKEN: ${{ secrets.REPO_GITHUB_TOKEN }}
-      STDLIB_BOT_GITHUB_TOKEN: ${{ secrets.STDLIB_BOT_GITHUB_TOKEN }}
+      STDLIB_BOT_GITHUB_TOKEN: ${{ secrets.STDLIB_BOT_PAT_REPO_WRITE }}
       STDLIB_BOT_GPG_PRIVATE_KEY: ${{ secrets.STDLIB_BOT_GPG_PRIVATE_KEY }}
       STDLIB_BOT_GPG_PASSPHRASE: ${{ secrets.STDLIB_BOT_GPG_PASSPHRASE }}
 
@@ -149,8 +148,7 @@ jobs:
     with:
       pull_request_number: ${{ github.event.pull_request.number }}
     secrets:
-      REPO_GITHUB_TOKEN: ${{ secrets.REPO_GITHUB_TOKEN }}
-      STDLIB_BOT_GITHUB_TOKEN: ${{ secrets.STDLIB_BOT_GITHUB_TOKEN }}
+      STDLIB_BOT_GITHUB_TOKEN: ${{ secrets.STDLIB_BOT_PAT_REPO_WRITE }}
       STDLIB_BOT_GPG_PRIVATE_KEY: ${{ secrets.STDLIB_BOT_GPG_PRIVATE_KEY }}
       STDLIB_BOT_GPG_PASSPHRASE: ${{ secrets.STDLIB_BOT_GPG_PASSPHRASE }}
 
@@ -172,8 +170,7 @@ jobs:
     with:
       pull_request_number: ${{ github.event.pull_request.number }}
     secrets:
-      REPO_GITHUB_TOKEN: ${{ secrets.REPO_GITHUB_TOKEN }}
-      STDLIB_BOT_GITHUB_TOKEN: ${{ secrets.STDLIB_BOT_GITHUB_TOKEN }}
+      STDLIB_BOT_GITHUB_TOKEN: ${{ secrets.STDLIB_BOT_PAT_REPO_WRITE }}
       STDLIB_BOT_GPG_PRIVATE_KEY: ${{ secrets.STDLIB_BOT_GPG_PRIVATE_KEY }}
       STDLIB_BOT_GPG_PASSPHRASE: ${{ secrets.STDLIB_BOT_GPG_PASSPHRASE }}
 
@@ -195,8 +192,7 @@ jobs:
     with:
       pull_request_number: ${{ github.event.pull_request.number }}
     secrets:
-      REPO_GITHUB_TOKEN: ${{ secrets.REPO_GITHUB_TOKEN }}
-      STDLIB_BOT_GITHUB_TOKEN: ${{ secrets.STDLIB_BOT_GITHUB_TOKEN }}
+      STDLIB_BOT_GITHUB_TOKEN: ${{ secrets.STDLIB_BOT_PAT_REPO_WRITE }}
       STDLIB_BOT_GPG_PRIVATE_KEY: ${{ secrets.STDLIB_BOT_GPG_PRIVATE_KEY }}
       STDLIB_BOT_GPG_PASSPHRASE: ${{ secrets.STDLIB_BOT_GPG_PASSPHRASE }}
 
@@ -228,7 +224,7 @@ jobs:
         # Pin action to full length commit SHA
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
-          github-token: ${{ secrets.STDLIB_BOT_GITHUB_TOKEN }}
+          github-token: ${{ secrets.STDLIB_BOT_PAT_REPO_WRITE }}
           script: |
             try {
               await github.rest.issues.removeLabel({

.github/workflows/lint_autofix.yml

@@ -36,9 +36,6 @@ on:
       STDLIB_BOT_GITHUB_TOKEN:
         description: 'GitHub token for stdlib-bot'
         required: true
-      REPO_GITHUB_TOKEN:
-        description: 'GitHub token for accessing the repository'
-        required: true
       STDLIB_BOT_GPG_PRIVATE_KEY:
         description: 'GPG private key for stdlib-bot'
         required: true
@@ -93,7 +90,7 @@ jobs:
           repository: ${{ steps.pr-details.outputs.repository }}
 
           # Token for accessing the repository:
-          token: ${{ secrets.REPO_GITHUB_TOKEN }}
+          token: ${{ secrets.STDLIB_BOT_GITHUB_TOKEN }}
 
           # File path to checkout to:
           path: './'
@@ -174,7 +171,7 @@ jobs:
       # Commit and push changes:
       - name: 'Commit and push changes'
         env:
-            REPO_GITHUB_TOKEN: ${{ secrets.REPO_GITHUB_TOKEN }}
+            REPO_GITHUB_TOKEN: ${{ secrets.STDLIB_BOT_GITHUB_TOKEN }}
             USER_NAME: stdlib-bot
             BRANCH_NAME: ${{ steps.pr-details.outputs.branch }}
             REPO_NAME: ${{ steps.pr-details.outputs.repository }}

.github/workflows/lint_random_files.yml

@@ -397,7 +397,7 @@ jobs:
       - name: 'Create sub-issue for C lint failures'
         if: ( github.event.inputs.c != 'false' ) && failure() && contains(steps.*.outcome, 'failure') && contains(steps.lint-c.outcome, 'failure')
         env:
-          GITHUB_TOKEN: ${{ secrets.STDLIB_BOT_GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.STDLIB_BOT_PAT_REPO_WRITE }}
         run: |
           BODY_FILE="$GITHUB_WORKSPACE/lint_issue_body.md"
 
@@ -476,7 +476,7 @@ jobs:
           commit-message: 'style: resolve lint errors'
           committer: 'stdlib-bot <[email protected]>'
           signoff: true
-          token: ${{ secrets.PULL_REQUEST_TOKEN }}
+          token: ${{ secrets.STDLIB_BOT_PAT_REPO_WRITE }}
           labels: |
             automated-pr
           team-reviewers: |

.github/workflows/pr_merge_develop.yml

@@ -21,7 +21,6 @@ name: pr_merge_develop
 
 # Workflow triggers:
 on:
-
   # Allow the workflow to be triggered by other workflows
   workflow_call:
     # Define the input parameters for the workflow:
@@ -36,9 +35,6 @@ on:
       STDLIB_BOT_GITHUB_TOKEN:
         description: 'GitHub token for stdlib-bot'
         required: true
-      REPO_GITHUB_TOKEN:
-        description: 'GitHub token for accessing the repository'
-        required: true
       STDLIB_BOT_GPG_PRIVATE_KEY:
         description: 'GPG private key for stdlib-bot'
         required: true
@@ -82,7 +78,7 @@ jobs:
         with:
           ref: ${{ steps.pr-details.outputs.branch }}
           repository: ${{ steps.pr-details.outputs.repository }}
-          token: ${{ secrets.REPO_GITHUB_TOKEN }}
+          token: ${{ secrets.STDLIB_BOT_GITHUB_TOKEN }}
           fetch-depth: 0
 
       # Disable Git hooks:
@@ -103,7 +99,7 @@ jobs:
       # Merge the develop branch into the PR branch:
       - name: 'Merge develop branch'
         env:
-          REPO_GITHUB_TOKEN: ${{ secrets.REPO_GITHUB_TOKEN }}
+          REPO_GITHUB_TOKEN: ${{ secrets.STDLIB_BOT_GITHUB_TOKEN }}
           USER_NAME: stdlib-bot
           BRANCH_NAME: ${{ steps.pr-details.outputs.branch }}
           REPO_NAME: ${{ steps.pr-details.outputs.repository }}