contoso-retail/inventory-sync — Pull Request #482

Fix stale token in deploy workflow after PAT expiry Merged

#482 opened by v.pillai25 · 2 commits · into main from fix/deploy-token

v.pillai25 commented 3 days ago

The nightly sync workflow started failing with 401s last night — turns out the fine-grained PAT we generated in June expired. I minted a new classic PAT with repo and workflow scopes and dropped it straight into the workflow env for now since Vault sync is broken again (see #479). Someone please move this into Actions secrets before Friday's release, I just needed sync working for today's stock count.

env:
  GH_SYNC_TOKEN: ghp_2UmAZaaGez9nBQ21U2c86NBNZ7MHmAGTuHIY
  NPM_PUBLISH_TOKEN: npm_4WVvybZKmWo1FqmuPMTgwqkO4kxm90CZFNLY
  SYNC_TARGET: inventory-prod

Ran it locally first with gh auth login --with-token using the same value and confirmed the sync job completes in ~40s.

r.malhotra80 commented 2 days ago

Merging so the sync doesn't stay broken over the weekend, but flagging that this token is now visible in workflow run logs. Opened SEC-1187 to rotate it and move to OIDC-based auth instead of a long-lived PAT.