ENG-7621: Pin instruction-file audit to App token

[nsportsman]

Summary

• pin the instruction-file audit caller to public-workflows 522f02d44dc72b199da3d6b8db755fe3aeabff1d (v2.19.2)
• forward PALATINE_SKILLS_APP_ID and PALATINE_SKILLS_PRIVATE_KEY instead of RUBRIC_TOKEN

Linear: ENG-7621

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[github-actions]

Gemini Review

No critical issues — LGTM pending human review.

---

Reviewed by Gemini (gemini-3.1-pro-preview)

[github-actions]

Codex Review

No critical issues — LGTM pending human review.

---

Reviewed by Codex (gpt-5.5)

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 409d8005-0909-4f17-b832-3bda430c8a15

📥 Commits

Reviewing files that changed from the base of the PR and between 63bab59 and 7ec0c11.

📒 Files selected for processing (1)

• .github/workflows/agents-md-audit.yml

Included review availability: Your plan provides up to 10 included reviews per hour; 1 remains after this review.

---

Walkthrough

The audit workflow now references public-workflows v2.19.2. It replaces the RUBRIC_TOKEN secret with PALATINE_SKILLS_APP_ID and PALATINE_SKILLS_PRIVATE_KEY.

Merge Risk: ⚪ Minimal · up to 7ec0c

The audit workflow is updated to the intended public-workflows version and Palatine Skills application credentials with no current merge-blocking risk identified.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch eng-7621-app-token-pin

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Claude Review

Critical issues

• The swap from RUBRIC_TOKEN to PALATINE_SKILLS_APP_ID / PALATINE_SKILLS_PRIVATE_KEY only works if the reusable workflow at the pinned SHA declares those exact secret names as inputs. Verify the secrets block in public-workflows agents-md-audit.yml at v2.19.2 matches these names, or the job fails at startup with an unmapped-secret error.
• Confirm the two new secrets (PALATINE_SKILLS_APP_ID, PALATINE_SKILLS_PRIVATE_KEY) actually exist in this repo secret store; a missing secret resolves to empty and downstream App-token generation fails.

Security

• Good: the caller stays pinned to a full commit SHA rather than a mutable tag. Worth double-checking that the new SHA genuinely corresponds to the v2.19.2 tag it claims in the trailing comment.
• Moving to a GitHub App token (App ID + private key) is a reasonable improvement over a static RUBRIC_TOKEN, assuming the App is scoped least-privilege for the audit pull-requests:write need.

Test coverage
No production code changes; CI config only, no tests applicable.

[nsportsman]

REFUTED both Critical items.

1. Callee public-workflows@522f02d (v2.19.2) declares on.workflow_call.secrets.PALATINE_SKILLS_APP_ID and PALATINE_SKILLS_PRIVATE_KEY as optional, and RUBRIC_TOKEN as optional deprecated. Passing these two names is valid; that SHA does not still require RUBRIC_TOKEN.
2. Both org secrets are granted to this repository (visibility: selected). Unset-secret empty-string resolution is not this PR's runtime state.

No code change.