ci: use GITHUB_TOKEN instead of PAT for PR severity workflow
What the developer wrote
Authored by ziggie
ci: use GITHUB_TOKEN instead of PAT for PR severity workflow
The PR severity classifier only needs to run `gh pr view`, `gh pr edit`
(labels), and `gh pr comment`. All three operations are fully covered by
the built-in GITHUB_TOKEN given the existing permissions block:
permissions:
contents: read
pull-requests: write
issues: write
The workflow uses `pull_request_target`, which runs in the base repo
context, so GITHUB_TOKEN has write access even for fork PRs.
Inspection of the claude-code-action@v1 source confirmed that the only
internal call that would require `contents: write` is branch deletion,
which is never exercised here because Claude's tools are locked down to
`gh pr view/edit/comment` via --allowedTools.
This removes the dependency on the PR_SEVERITY_BOT_TOKEN PAT secret.
What changed, and why it matters
This commit changes a GitHub Actions workflow so it uses the automatically provided GITHUB_TOKEN instead of a long-lived personal access token (PAT) named PR_SEVERITY_BOT_TOKEN. The workflow labels and comments on pull requests. The change reduces the risk that a leaked or overly powerful PAT could be misused, and it is a security-hardening improvement rather than a fix for an active vulnerability.
Review the permissions block to confirm it is minimal (contents: read may not be needed if only PR metadata is read), verify that claude-code-action@v1 cannot bypass --allowedTools, and consider rotating or deleting the now-unused PR_SEVERITY_BOT_TOKEN secret. No urgent patch is required.
Security signals we found
Removal of a long-lived personal access token (PAT) from CI/CD
Use of built-in GITHUB_TOKEN with scoped permissions
Workflow runs on pull_request_target, which has elevated context implications
Third-party action (anthropics/claude-code-action@v1) receives repository token
Claimed tool lockdown via --allowedTools to limit gh operations
Evidence from the diff
The pr-severity.yml workflow, which runs on pull_request_target, previously passed a PAT (PR_SEVERITY_BOT_TOKEN) to anthropics/claude-code-action@v1. The commit replaces that with secrets.GITHUB_TOKEN. The workflow already declares permissions of contents: read, pull-requests: write, and issues: write, which the commit message argues are sufficient for the gh pr view/edit/comment operations the action performs. Because pull_request_target runs in the base repository context, GITHUB_TOKEN has write access for fork PRs. The commit removes reliance on a long-lived secret and narrows the credential surface.
Changed components
.github/workflows/pr-severity.ymlGitHub Actions CI workflow for PR severity classificationanthropics/claude-code-action@v1 integrationInspect captured patch +1 / −1
diff --git a/.github/workflows/pr-severity.yml b/.github/workflows/pr-severity.yml
index 59ca136..6b48977 100644
--- a/.github/workflows/pr-severity.yml
+++ b/.github/workflows/pr-severity.yml
@@ -35,7 +35,7 @@ jobs:
uses: anthropics/claude-code-action@v1
with:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
- github_token: ${{ secrets.PR_SEVERITY_BOT_TOKEN }}
+ github_token: ${{ secrets.GITHUB_TOKEN }}
# Allow any user since this workflow only reads PR metadata via API
# and doesn't execute any code from the PR. Tool permissions are
Why this scored 32/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.