chore(ci): migrate all workflows from PAT to GITHUB_TOKEN/App Token [SEC-58]

[lvrach]

Summary

• Migrates all PAT usages to GITHUB_TOKEN or GitHub App Token
• Adds explicit permissions at job level with comments explaining why
• Follows January 2026 guidelines for token generation and permissions
• Uses ryancyq/github-signed-commit for verified commits via GitHub API
• Simplifies draft-new-release.yml by removing unnecessary git commands

Files Changed

• .github/workflows/notion-pr-sync.yml
• .github/workflows/draft-new-release.yml
• .github/workflows/publish-new-release.yml

Migration Details

File	Token Type	Permissions	Change Made
notion-pr-sync.yml	GITHUB_TOKEN	pull-requests: read	Added job-level permissions, replaced PAT with GITHUB_TOKEN
draft-new-release.yml	GitHub App Token	contents: write, pull-requests: write	Added token generation step, simplified with API-based branch creation
publish-new-release.yml	GitHub App Token	contents: write	Added token generation step, updated permissions, replaced PAT

Migration Pattern Evolution

1. The signed-commit action (ryancyq/github-signed-commit) creates commits via GitHub's GraphQL API, producing verified commits with the App's identity
2. This eliminates the need for many git commands: git config, git add, git commit, git push
3. The key insight is that branches must be created via GitHub API (gh api .../git/refs) before the signed-commit action can push to them

Key Changes

1. notion-pr-sync.yml: Migrated to GITHUB_TOKEN (only reads PR metadata, no need for App Token)
2. draft-new-release.yml:
   • Migrated to GitHub App Token (creates PRs that must trigger CI)
   • Removed unnecessary git config, git checkout -b, git push commands
   • Added branch creation via GitHub API (gh api repos/${{ github.repository }}/git/refs)
   • Uses standard-version --skip.commit --skip.tag to generate files without committing
   • The signed-commit action reads files directly from filesystem and creates verified commits via GitHub API
3. publish-new-release.yml: Migrated to GitHub App Token (creates releases)

All changes follow the pattern:

• Generate App Token BEFORE checkout
• Pass App Token to checkout via token: input
• Use App Token for all write operations
• Set minimal permissions for GITHUB_TOKEN (contents: read)

Test plan

• Verify notion-pr-sync works when PR is opened/updated
• Verify draft-new-release creates release branches and PRs with verified commits
• Verify publish-new-release creates GitHub releases correctly

🤖 Generated with Claude Code