[TT-17030] Migrate workflows from PAT to GitHub App token

[buger]

Summary

• Replace ORG_GH_TOKEN (PAT) with GitHub App token generation using actions/create-github-app-token in godoc.yml and nancy.yaml
• Update workflow_call secret declarations: replace ORG_GH_TOKEN with PROBE_APP_ID and PROBE_APP_PRIVATE_KEY
• Fix git config insteadOf patterns in both workflows to use the generated app token
• Note: Callers of these reusable workflows will need to be updated to pass PROBE_APP_ID and PROBE_APP_PRIVATE_KEY instead of ORG_GH_TOKEN

Test plan

• Verify PROBE_APP_ID and PROBE_APP_PRIVATE_KEY secrets are configured at the org level
• Update caller workflows to pass the new secrets
• Test a PR that triggers the godoc workflow to confirm API change detection works
• Test the nancy scan workflow to confirm Go dependency scanning works

🤖 Generated with Claude Code

[probelabs]

This PR migrates two reusable GitHub Actions workflows, godoc.yml and nancy.yaml, from using a static Personal Access Token (ORG_GH_TOKEN) to a dynamically generated, short-lived GitHub App token for authentication. This change enhances security by adhering to the principle of least privilege and avoiding the use of long-lived credentials.

The core modification involves introducing the actions/create-github-app-token action in both workflows. This action uses the new organization secrets PROBE_APP_ID and PROBE_APP_PRIVATE_KEY to generate a temporary token, which is then used for subsequent steps like checking out code and configuring Git access for private modules.

This is a breaking change for all workflows that consume godoc.yml or nancy.yaml. Calling workflows must be updated to pass the new GitHub App secrets instead of the old PAT.

Files Changed Analysis

• .github/workflows/godoc.yml: Modified to accept GitHub App credentials, add a token generation step, and use the new token for git config and the checkout-pr action.
• .github/workflows/nancy.yaml: Similarly modified to use the GitHub App token for authenticating Git access to private Go modules during the dependency scan.

The changes are consistent and localized to these two workflow files, with a total of 25 additions and 5 deletions.

Architecture & Impact Assessment

• What this PR accomplishes: It improves the security posture of the CI/CD system by replacing a static, broadly-scoped PAT with a more secure, just-in-time token generated via a GitHub App.
• Key technical changes introduced:
  1. Adoption of the actions/create-github-app-token action for authentication.
  2. The workflow_call trigger's secret interface is changed from ORG_GH_TOKEN to PROBE_APP_ID and PROBE_APP_PRIVATE_KEY.
  3. All steps requiring Git authentication within the workflows are updated to use the output of the token generation step.
• Affected system components: The godoc and nancy reusable workflows are directly affected. Critically, all external repositories and workflows that call these two reusable workflows are indirectly impacted and will require updates to their secret management and workflow definitions.

Authentication Flow Change

graph TD
    subgraph "Old Flow (PAT)"
        A[Caller Workflow] -- "passes ORG_GH_TOKEN" --> B[Reusable Workflow];
        B -- "uses ORG_GH_TOKEN for" --> C[Git Operations];
    end

    subgraph "New Flow (GitHub App)"
        D[Caller Workflow] -- "passes App ID & Key" --> E[Reusable Workflow];
        E -- "uses App ID & Key with" --> F(actions/create-github-app-token);
        F -- "generates short-lived token" --> E;
        E -- "uses token for" --> G[Git Operations];
    end

Loading

Scope Discovery & Context Expansion

The immediate scope is limited to the two modified workflow files. However, the true impact extends to every CI pipeline that utilizes them. To fully assess the blast radius of this breaking change, it would be necessary to find all call sites of these workflows across the organization's repositories.

If tools were available, the next step would be to perform a codebase search for strings like:

• uses: TykTechnologies/github-actions/.github/workflows/godoc.yml
• uses: TykTechnologies/github-actions/.github/workflows/nancy.yaml

This would identify all dependent workflows that need to be updated to ensure CI pipelines do not break upon merging this change.

Metadata

• Review Effort: 2 / 5
• Primary Label: chore

---

Powered by Visor from Probelabs

Last updated: 2026-04-22T15:14:56.079Z | Triggered by: pr_opened | Commit: fde14e8

💡 TIP: You can chat with Visor using /visor ask <your question>

[probelabs]

Security Issues (2)

Severity	Location	Issue
🟡 Warning	.github/workflows/nancy.yaml:10-12	The secrets `PROBE_APP_ID` and `PROBE_APP_PRIVATE_KEY` are marked as `required: false`, but the 'Generate GitHub App token' step (lines 18-24) uses them unconditionally. If these secrets are not provided by the calling workflow, this step will fail, causing the entire job to fail. This is inconsistent with `godoc.yml` where these secrets are marked as `required: true`. 💡 Suggestion If these secrets are always required for this workflow to access private modules, change `required: false` to `required: true`. This ensures the workflow fails fast with a clear error message if the secrets are omitted. If the workflow is intended to work on repositories without private dependencies, the steps requiring authentication should be made conditional, e.g., by adding `if: ${{ secrets.PROBE_APP_ID != '' }}` to the 'Generate GitHub App token' step and subsequent steps that use the token.
🟡 Warning	.github/workflows/godoc.yml:21-27	While migrating from a PAT to a GitHub App token is a significant security improvement, the overall security of this change depends on the permissions granted to the GitHub App. The generated token will inherit all permissions of the app, and if the app is over-privileged, it could create a security risk. 💡 Suggestion As part of this migration, please verify that the GitHub App identified by `PROBE_APP_ID` is configured with the minimum set of permissions required for its tasks (the principle of least privilege). For example, it likely only needs read access to code to fetch private dependencies and perform API analysis.

Architecture Issues (4)

Severity	Location	Issue
🟠 Error	.github/workflows/godoc.yml:28	The `owner` parameter for the `create-github-app-token` action is hard-coded to `TykTechnologies`. For a reusable workflow, this should be dynamic to support execution in forks or other organizations. Using a hard-coded value limits portability. 💡 Suggestion Replace the hard-coded owner with the `github.repository_owner` context variable to make the workflow more generic and reusable. Change `owner: TykTechnologies` to `owner: ${{ github.repository_owner }}`. 🔧 Suggested Fix owner: ${{ github.repository_owner }}
🟠 Error	.github/workflows/nancy.yaml:17-23	The secrets `PROBE_APP_ID` and `PROBE_APP_PRIVATE_KEY` are marked as `required: false`, implying the workflow can run without them. However, the 'Generate GitHub App token' step runs unconditionally and will fail if these secrets are not provided, making them effectively mandatory. This contradicts the secret declaration. 💡 Suggestion To align with the optional nature of the secrets, make the token generation step conditional. Add an `if` condition to execute it only when the secrets are present, for example: `if: secrets.PROBE_APP_ID && secrets.PROBE_APP_PRIVATE_KEY`. Subsequent steps using the token must also be made conditional.
🟠 Error	.github/workflows/nancy.yaml:22	The `owner` parameter for the `create-github-app-token` action is hard-coded to `TykTechnologies`. For a reusable workflow, this should be dynamic to support execution in forks or other organizations. Using a hard-coded value limits portability. 💡 Suggestion Replace the hard-coded owner with the `github.repository_owner` context variable to make the workflow more generic and reusable. Change `owner: TykTechnologies` to `owner: ${{ github.repository_owner }}`. 🔧 Suggested Fix owner: ${{ github.repository_owner }}
🟡 Warning	.github/workflows/godoc.yml:23-29	The logic for generating a GitHub App token is duplicated in both `godoc.yml` and `nancy.yaml`. This violates the DRY principle and increases maintenance overhead. In a repository dedicated to reusable GitHub Actions, this pattern should be abstracted. 💡 Suggestion Create a new reusable composite action within this repository (e.g., at `.github/actions/generate-app-token`) to encapsulate the token generation step. Both `godoc.yml` and `nancy.yaml` can then call this single action, reducing duplication and centralizing the authentication logic.

✅ Performance Check Passed

No performance issues found – changes LGTM.

---

Powered by Visor from Probelabs

Last updated: 2026-04-22T15:14:54.659Z | Triggered by: pr_opened | Commit: fde14e8

💡 TIP: You can chat with Visor using /visor ask <your question>