ci: migrate workflows off retired GH_PAT secret, consolidate security scans

.github/workflows/ci.yaml

@@ -8,14 +8,22 @@
 #   - go-version-file: go.mod instead of hardcoded version
 #   - Removed Force Remote Dependency step — replace directives must not be
 #     committed to go.mod; local replace is development-only
-#   - Removed -mod=vendor — controller fetches deps via SSH + GOPRIVATE at
+#   - Removed -mod=vendor — controller fetches deps via HTTPS + GOPRIVATE at
 #     build time; vendor directory is not committed in this repo
 #   - golangci-lint replaces staticcheck — consistent with library CI
 #   - go vet added before lint
 #   - GONOSUMDB + GOPRIVATE + GOPROXY=direct set consistently
 #
+# Auth:
+#   Private-module git config (environments, environments-api,
+#   environments-contract) uses the BlanketOps-Environments GitHub App (via
+#   actions/create-github-app-token) instead of a personal-account PAT —
+#   installation tokens are minted fresh per job and expire in an hour,
+#   instead of a PAT's expiry silently lapsing.
+#
 # Secrets required:
-#   GH_PAT — private module access
+#   APP_ID, APP_PRIVATE_KEY — GitHub App credentials, exchanged for a
+#   short-lived installation token per job (private-module access only)
 # =============================================================================
 
 name: CI
@@ -36,6 +44,15 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          owner: blanketops
+          repositories: environments,environments-api,environments-contract
+
       - name: Checkout
         uses: actions/checkout@v4
 
@@ -47,7 +64,7 @@ jobs:
 
       - name: Configure Git for private modules
         run: |
-          git config --global url."https://${{ secrets.GH_PAT }}@github.com/".insteadOf "https://github.com/"
+          git config --global url."https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/".insteadOf "https://github.com/"
           go env -w GOPRIVATE=github.com/blanketops/*
           go env -w GONOSUMDB=github.com/blanketops/*
           go env -w GOPROXY=direct
@@ -58,6 +75,18 @@ jobs:
       - name: Vet
         run: go vet ./...
 
+      - name: Test
+        run: go test ./... -coverprofile=coverage.out -covermode=atomic
+
+      - name: Coverage summary
+        if: always()
+        run: |
+          TOTAL=$(go tool cover -func=coverage.out 2>/dev/null | grep "^total" | awk '{print $3}' || echo "N/A")
+          cat >> "$GITHUB_STEP_SUMMARY" <<EOF
+          ## Test Coverage
+          **Total:** \`${TOTAL}\`
+          EOF
+
       - name: Lint
         uses: golangci/golangci-lint-action@v7
         with:

.github/workflows/create-release.yml

@@ -1,3 +1,14 @@
+# Auth:
+#   Uses the BlanketOps-Environments GitHub App (via
+#   actions/create-github-app-token) instead of a personal-account PAT — a
+#   push/PR made with the default GITHUB_TOKEN does not trigger downstream
+#   workflow runs (e.g. CI on the new release branch), but an App
+#   installation token does, same as a PAT would.
+#
+# Secrets required:
+#   APP_ID, APP_PRIVATE_KEY — GitHub App credentials, exchanged for a
+#   short-lived installation token scoped to this repo
+
 name: Create Release
 
 on:
@@ -17,12 +28,21 @@ jobs:
 
 
     steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          owner: blanketops
+          repositories: environments-controller
+
       - name: Checkout develop
         uses: actions/checkout@v4
         with:
           ref: develop
           fetch-depth: 0
-          token: ${{ secrets.GH_PAT }}
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: Configure git
         run: |
@@ -36,7 +56,7 @@ jobs:
 
       - name: Open PR to main
         env:
-          GH_TOKEN: ${{ secrets.GH_PAT }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           gh pr create \
             --base main \

.github/workflows/finalize-release.yml

@@ -1,3 +1,14 @@
+# Auth:
+#   Uses the BlanketOps-Environments GitHub App (via
+#   actions/create-github-app-token) instead of a personal-account PAT — a
+#   push made with the default GITHUB_TOKEN does not trigger downstream
+#   workflow runs (notably the tag push below, which release.yml listens
+#   for), but an App installation token does, same as a PAT would.
+#
+# Secrets required:
+#   APP_ID, APP_PRIVATE_KEY — GitHub App credentials, exchanged for a
+#   short-lived installation token scoped to this repo
+
 name: Finalize Release
 on:
   workflow_dispatch:
@@ -11,11 +22,20 @@ jobs:
   finalize:
     runs-on: ubuntu-latest
     steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          owner: blanketops
+          repositories: environments-controller
+
       - name: Checkout
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.GH_PAT }}
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: Configure git
         run: |

.github/workflows/ko.yml

@@ -20,8 +20,20 @@
 #   tag push  → {version} + latest
 #   manual    → {ref_name} only
 #
+# Auth:
+#   Private-module git config uses the BlanketOps-Environments GitHub App
+#   (via actions/create-github-app-token) instead of a personal-account PAT
+#   — installation tokens are minted fresh per job and expire in an hour,
+#   instead of a PAT's expiry silently lapsing.
+#
+#   GHCR login uses GITHUB_TOKEN, not the App token — the App installation
+#   token was denied "Write organization package" against this GHCR package
+#   regardless of what permission was granted. GITHUB_TOKEN is scoped to
+#   this repo only, which is exactly what a same-repo package push needs.
+#
 # Secrets required:
-#   GH_PAT — GHCR push + private module git access (HTTPS)
+#   APP_ID, APP_PRIVATE_KEY — GitHub App credentials, exchanged for a
+#   short-lived installation token per job (private-module access only)
 # =============================================================================
 
 name: Ko Image
@@ -51,6 +63,15 @@ jobs:
   build-and-publish:
     runs-on: ubuntu-latest
     steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          owner: blanketops
+          repositories: environments,environments-api,environments-contract
+
       - uses: actions/checkout@v4
 
       - name: Setup Go
@@ -61,7 +82,7 @@ jobs:
 
       - name: Configure git for private modules
         run: |
-          git config --global url."https://${{ secrets.GH_PAT }}@github.com/".insteadOf "https://github.com/"
+          git config --global url."https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/".insteadOf "https://github.com/"
           go env -w GOPRIVATE=github.com/blanketops/*
           go env -w GONOSUMDB=github.com/blanketops/*
           go env -w GOPROXY=direct
@@ -81,10 +102,10 @@ jobs:
 
       - name: Login to GHCR
         run: |
-          echo "${{ secrets.GH_PAT }}" | ko login ghcr.io \
+          echo "${{ secrets.GITHUB_TOKEN }}" | ko login ghcr.io \
             --username "${{ github.actor }}" \
             --password-stdin
-          echo "${{ secrets.GH_PAT }}" | oras login ghcr.io \
+          echo "${{ secrets.GITHUB_TOKEN }}" | oras login ghcr.io \
             --username "${{ github.actor }}" \
             --password-stdin
 

.github/workflows/release.yml

@@ -53,7 +53,7 @@ jobs:
           with:
             registry: ghcr.io
             username: ${{ github.actor }}
-            password: ${{ secrets.GH_PAT }}
+            password: ${{ secrets.GITHUB_TOKEN }}
 
         # ko.yml builds and pushes this same tag concurrently (both fire on
         # the same tag push) — poll rather than assume it's already there.
@@ -93,7 +93,7 @@ jobs:
           with:
             body_path: RELEASE_NOTES.md
           env:
-            GITHUB_TOKEN: ${{ secrets.GH_PAT }}
+            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
         - name: Release Summary
           run: |