[DO NOT MERGE] test(ci): validate GH_PAT_TO_ACCESS_GITHUB_API as release-push token

[CRThaze]

Do not merge. Test-only.

Validates that secrets.GH_PAT_TO_ACCESS_GITHUB_API is a safe drop-in replacement for secrets.GHA_COMMIT_TO_MASTER_PAT, as proposed in #13.

Why this needs validating

In release.yaml, the ad-m/github-push-action step pushes the helm-docs README commit directly to main. main is guarded by the "Protect Main" ruleset (PR + code-owner review + verify-version), so a direct push only succeeds when the token's identity is a member of a bypass team: deployment-team or deployment-team-actions. The old PAT pushed as CometActions, which is in both.

So the swap in #13 works iff GH_PAT_TO_ACCESS_GITHUB_API authenticates as an identity that is push-capable and in one of those bypass teams.

What the workflow does

.github/workflows/test-pat-validation.yaml runs on this PR (and via workflow_dispatch) and:

1. asserts the secret is present (value stays masked);
2. reveals which identity the PAT authenticates as (gh api user);
3. confirms that identity has push permission on the repo;
4. gives a PASS/REVIEW verdict on main-ruleset bypass (known bypass roster + best-effort live team check) — see the run's step summary;
5. proves the token can actually push, using the same action release.yaml uses (ad-m/github-push-action), against a throwaway branch pat-validate/<run_id>;
6. deletes that throwaway branch.

main is never written to.

How to read the result

• Green check + step-summary PASS -> the token authenticates, can push, and bypasses Protect Main. Safe to merge Update GitHub Actions token for pushing changes to main branch #13.
• REVIEW warning -> the PAT owner is not in a bypass team; add it to deployment-team(-actions) first, or the release push to main will be rejected.

Cleanup

Close this PR without merging and delete the branch. The one throwaway pat-validate/* branch is self-deleted by the workflow.

[github-actions]

📊 Helm Render Diff Summary

Chart charts/s3proxy rendered with Kubernetes 1.29.0. Informational only — this check never fails the PR.

Values File	Chart Path	Changes	Status
test-values/autoscaling.yaml	charts/s3proxy	-	✅ No Changes
test-values/azureblob.yaml	charts/s3proxy	-	✅ No Changes
test-values/b2.yaml	charts/s3proxy	-	✅ No Changes
test-values/filesystem.yaml	charts/s3proxy	-	✅ No Changes
test-values/gcs.yaml	charts/s3proxy	-	✅ No Changes
test-values/ingress.yaml	charts/s3proxy	-	✅ No Changes
test-values/multi-backend.yaml	charts/s3proxy	-	✅ No Changes
test-values/openstack-swift.yaml	charts/s3proxy	-	✅ No Changes
test-values/rackspace.yaml	charts/s3proxy	-	✅ No Changes
test-values/s3.yaml	charts/s3proxy	-	✅ No Changes
test-values/tls-existing-secret.yaml	charts/s3proxy	-	✅ No Changes
test-values/tls.yaml	charts/s3proxy	-	✅ No Changes
test-values/transient.yaml	charts/s3proxy	-	✅ No Changes

🎉 No changes detected in any of the tested configurations!