Use built-in token for public team-memory source reads

[Changyong Gong (chagong)]

Summary

Use the coordinator job's built-in ${{ github.token }} explicitly for allowlisted public-source metadata reads. Remove the source-selection shell step and external-source actions/create-github-app-token step, including their obsolete source-name/external outputs and token-selection expression.

This changes only .github/workflows/team-memory-coordinator.yml (1 insertion, 31 deletions). Preserve the default-branch/event/opt-in gate, job-scoped Contents/Actions/Pull requests read and ID token write permissions, wiki-specific concurrency with queue: max and cancel-in-progress: false, all eight trusted repository IDs, all five source/run/range inputs and manual PR input, final receipt validation, and privacy-safe output-mode: activity / summary-mode: status.

The trusted shared action remains pinned to a81d2d96167fc0e69ac631c2edc85f858e693289. Its existing preflight validates the trusted allowlist, canonical source identity/ID, and public source/coordinator restrictions before reconciliation discovery and OIDC login. No duplicate local preflight, anonymous fallback, or token-bearing payload is added. microsoft/IssueLens#54 corrects contract wording/tests without changing runtime; this PR does not depend on its merge or repin to an unmerged action.

Setup impact

The coordinator no longer needs ISSUELENS_SOURCE_READ_APP_CLIENT_ID or ISSUELENS_SOURCE_READ_APP_PRIVATE_KEY. No new variables, secrets, settings, or credentials are required; existing opt-in and Azure OIDC/agent configuration is unchanged. This PR removes the workflow's use of that source-read credential pair only, not installed Apps or stored secrets.

External source callers' source-dispatch App credentials still need target Java Pack Contents read and Actions write. Their token minting and all seven external callers are untouched; this change alone does not fix their failed push/dispatch runs. The same-repository dispatcher still uses github.token for its own writes. No public documentation, application policies/prompts, or shared runtime files change.

Evidence and validation

• Prior isolated built-in-token diagnostic succeeded on attempt 1 at b18190a1cb932fdf0b5e02815af05075546b7e58. It recorded 43 HTTP 200 REST/GraphQL metadata reads across the coordinator and six external public sources using only the actual job GITHUB_TOKEN with Contents/Actions/Pull requests read and implicit Metadata access, without ID token permission, alternate tokens, anonymous fallback, retries, redirects, or agent/wiki invocation.
• That live evidence does not cover the seventh external source, microsoft/vscode-gradle (develop), conditional after..current-tip ancestry reads (all tested tips equaled after), or multi-page comparisons (the six tested ranges were one commit). Private cross-repository access is out of scope and rejected by the shared action.
• Session-local offline YAML checks using yaml 2.9.1 passed: the parsed workflow equals latest-main baseline b1035e0df4202be224c499934f2d63758e3b410a except the two removed authentication steps and source-token expression. Explicit assertions cover the gates, permissions/OIDC, concurrency, exact eight IDs, all input wiring/manual compatibility, fixed pin, receipts/privacy modes, unchanged dispatcher, and one-file scope. These are wiring checks, not mocked shared-runtime or new live token tests.
• Actionlint 1.7.12 checked both original and modified YAML. Both produce only the identical pre-existing line 36 diagnostic: unexpected key "queue" for "concurrency" section. expected one of "cancel-in-progress", "group" [syntax-check]. No other diagnostics occurred. GitHub's current concurrency documentation confirms queue: max is supported; it remains unchanged rather than being suppressed or removed.
• git diff --check and direct self-review passed. No workflow dispatch/rerun, Azure/IssueLens/wiki invocation, token minting, credential/settings changes, deployment, merge, or diagnostic-branch cleanup was performed.

[Copilot]

🟢 Approval recommended

The focused workflow change preserves required safeguards and is supported by the pinned action’s existing validation and successful live diagnostics.

0 open findings

What changed in this PR

Simplifies public team-memory source authentication by using the coordinator’s built-in GitHub token.

Changes:

• Removes source-selection and App-token creation steps.
• Uses ${{ github.token }} directly for source metadata reads.
• Preserves existing permissions, allowlist validation, and privacy settings.

File	Description
.github/​workflows/​team-memory-coordinator.yml	Replaces external source credentials with the built-in token.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.