Skip to content

fix(agents): keep github-token at platform/mctl-agents (revert PR #71) #79

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mashkovd merged 1 commit into from
Apr 30, 2026
Merged

fix(agents): keep github-token at platform/mctl-agents (revert PR #71) #79

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 10 additions & 22 deletions platform-gitops/argo-workflows/secrets/mctl-agents-secrets.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,10 +6,7 @@
# subscription quotas, no separate billing. See plan §4.3 for tradeoffs +
# fallback procedure to API key if OAuth ever breaks.
#
# Vault paths:
# - secret/platform/mctl-agents (this workflow's own keys)
# - secret/platform/mctl-agent/tokens (shared bot identity — github-token)
#
# Vault path: secret/platform/mctl-agents
# Keys (all optional individually — workflow degrades gracefully):
# - claude-code-oauth-token → CLAUDE_CODE_OAUTH_TOKEN (sk-ant-oat01-...)
# REQUIRED at runtime — workflow can't auth without it.
Expand All @@ -18,20 +15,16 @@
# Optional — without it the agents skip mcp__mctl__*
# tools and rely on WebSearch/WebFetch only.
# - github-token → GITHUB_TOKEN (PAT with repo scope on mctlhq/*)
# REQUIRED for the Tier 2 implementer step
# (`gh repo clone` + `gh pr create` against
# private mctlhq sibling repos). Pulled from
# the same Vault path as mctl-agent's bot
# identity so we keep one canonical token —
# rotating mctl-agent's token automatically
# rotates the implementer's too.
# Used by Tier 2 implementer (`gh repo clone` +
# `gh pr create` against private mctlhq sibling
# repos) and by the mctl-docs sibling-scan skill.
# Kept here (NOT pulled from the bot-identity
# Vault path) because this workflow's PAT carries
# broader repo scope than the bot identity does.
#
# `dataFrom: extract` pulls whatever subset of keys exists at
# platform/mctl-agents (claude-oauth, mctl-token). The explicit `data:`
# block below pulls github-token from the bot-identity path; ESO's default
# mergePolicy (Replace) means data: entries override anything dataFrom:
# might pull with the same secretKey, so we cannot accidentally pick up
# a stale local copy of github-token if one ever lands at platform/mctl-agents.
# We use `dataFrom: extract` so the ExternalSecret pulls whatever subset of
# keys exists at platform/mctl-agents. Adding new keys later requires no
# manifest change — just a `vault kv patch`.
#
# Seed via:
# claude setup-token # local; copy printed token
Expand Down Expand Up @@ -59,8 +52,3 @@ spec:
dataFrom:
- extract:
key: platform/mctl-agents
data:
- secretKey: github-token
remoteRef:
key: platform/mctl-agent/tokens
property: github-token