chore(ci): migrate all workflows from PAT to GITHUB_TOKEN/App Token [SEC-58]

[lvrach]

Summary

• Migrates all PAT usages to GITHUB_TOKEN or GitHub App Token
• Adds explicit permissions at job level with comments explaining why
• Follows January 2026 best practices for GitHub Actions security
• Uses simplified API-based pattern for verified commits

Files Changed

• .github/workflows/draft-new-release.yml
• .github/workflows/notion-pr-sync.yml
• .github/workflows/publish-new-release.yml

Migration Details

File	Token Type	Permissions	Changes
notion-pr-sync.yml	GITHUB_TOKEN	pull-requests: read	Replaced PAT with GITHUB_TOKEN for simple PR data sync
draft-new-release.yml	GitHub App Token	contents: write, pull-requests: write	Simplified pattern: removed git config/push, uses API-based branch creation
publish-new-release.yml	GitHub App Token	contents: write	Added token generation step, creates releases via API

Migration Pattern Evolution

The key insight from the pattern evolution is:

1. The signed-commit action (ryancyq/github-signed-commit) creates commits via GitHub's GraphQL API, producing verified commits with the App's identity
2. This eliminates the need for many git commands: git config, git add, git commit, git push
3. The key requirement is that branches must be created via GitHub API (gh api .../git/refs) before the signed-commit action can push to them

Changes in draft-new-release.yml

REMOVED (no longer needed):

• git config user.name/email steps - signed commit uses App identity
• git push --set-upstream origin - branch created via API

REPLACED WITH:

• Create branch via GitHub API: gh api repos/${{ github.repository }}/git/refs --method POST
• Use --skip.commit --skip.tag with standard-version (file modifications only)
• Use ryancyq/github-signed-commit@v1.2.0 for verified commits

Why These Changes?

notion-pr-sync.yml: Uses GITHUB_TOKEN because it only reads PR metadata for Notion sync. No workflow triggering needed.

draft-new-release.yml: Uses GitHub App Token + simplified pattern because:

• Git push with ANY token does NOT create verified commits
• Must use GitHub API via ryancyq/github-signed-commit@v1.2.0 for verified commits
• Branch creation via API eliminates need for git remote set-url with token-in-URL
• Created PRs must trigger downstream CI workflows

publish-new-release.yml: Uses GitHub App Token because:

• GITHUB_TOKEN cannot trigger other workflows (security feature)
• Requires write access to create releases and tags

Security Improvements

• Explicit permissions at job level (not workflow level)
• Minimal GITHUB_TOKEN permissions (contents: read)
• App Token generated early, before checkout
• App Token passed to checkout via token: parameter
• All permissions have explanatory comments
• Verified commits via GitHub API (not git push)

Test plan

• Verify notion-pr-sync workflow runs successfully with GITHUB_TOKEN
• Verify draft-new-release workflow creates PRs that trigger CI
• Verify draft-new-release creates verified commits (green checkmark)
• Verify publish-new-release workflow creates releases successfully

🤖 Generated with Claude Code