[product-manager-impersonator] Secret contract parity lint for reusable workflows

[github-actions]

Feature Idea

Summary: Add a lint check that keeps workflow_call.secrets contracts in sync across workflow source, compiled lock files, examples, and docs.

Why a Customer Would Want This

Downstream teams rely on reusable workflow secret contracts to wire tokens correctly (especially when they need label events to trigger follow-up workflows). When secret declarations drift between source/docs/examples, users get confusing setup failures and have to debug internals.

Rough Implementation Sketch

• Add scripts/check-workflow-secret-contracts.py to parse .github/workflows/gh-aw-*.md and extract workflow_call.secrets.
• For each workflow, compare against expected secret usage/declaration surfaces: .github/workflows/gh-aw-*.lock.yml, gh-agent-workflows/*/example.yml, and gh-agent-workflows/*/README.md (plus docs page where present).
• Fail with actionable per-workflow diffs (missing secret, undocumented secret, example mismatch).
• Wire the check into make lint and .github/workflows/ci.yml as a dedicated validation step.

Why It Won't Be That Hard

The repo already uses custom Python lint scripts and CI jobs for repository consistency checks, so this is an incremental extension of existing patterns rather than a new subsystem.

Evidence

• Current lint only runs workflow/action validators plus nav/catalog consistency (Makefile lines 243-244; .github/workflows/ci.yml lines 27-33), with no contract parity check.
• Development flow requires manual updates across multiple artifacts (gh-agent-workflows/DEVELOPING.md lines 145-161), which is where drift risk appears.
• Recent recurring fixes indicate this pain repeats across workflows: PRs feat(dependency-review): add optional GH_AW_GITHUB_TOKEN for label-triggered downstream workflows #1012, feat(issue-triage): expose GH_AW_GITHUB_TOKEN in workflow_call contract #1026, feat(issue-fixer): expose GH_AW_GITHUB_TOKEN in workflow_call contract #1027, Add classification-labels input and add-labels safe output to Issue Triage #1030 (token/secret contract and related wiring updates).
• Concrete current inconsistency surface to catch early: gh-aw-issue-fixer source defines only COPILOT_GITHUB_TOKEN and EXTRA_COMMIT_GITHUB_TOKEN (.github/workflows/gh-aw-issue-fixer.md lines 55-59), while usage/docs/examples must stay aligned (gh-agent-workflows/issue-fixer/example.yml lines 15-18; gh-agent-workflows/issue-fixer/README.md lines 25-37).

Note

🔒 Integrity filter blocked 59 items

The following items were blocked because they don't meet the GitHub integrity level.

• #937 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #359 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #1067 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• Mint Ephemeral Tokens #1067 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• Issue Triage allows issue labelling #1029 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• Issue Triage can use Ephemeral Token #1024 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #1025 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #1024 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #1010 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #20 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #248 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #875 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #424 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #76 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #185 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #272 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• ... and 43 more items

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

---

What is this? | From workflow: Trigger Product Manager Impersonator

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.