[Naor-Armo]

Summary

Replace the org-wide ARMOSEC_GITHUB_ACCESS_TOKEN PAT in the release job with a short-lived token minted from the REPO_READ_WRITE GitHub App, scoped to armoctl with contents: write only. armoctl is public; a long-lived PAT that reaches every armosec repo should not be readable by its workflows.

Source of Truth

N/A — CI credential hardening (narrowing org secrets exposed to public repos), no ticket.

Changes

• .github/workflows/pr-merged.yaml: add actions/create-github-app-token step (repositories: armoctl, permission-contents: write) and use its token for checkout, so the manifest-bump git push to main uses the App identity.

Prerequisites (org admin, before merge)

• Add armosec/armoctl as a selected repo for org secret REPO_READ_WRITE_APP_PRIVATE_KEY and org variable REPO_READ_WRITE_APP_ID (armoctl sees neither today).
• Make sure the REPO_READ_WRITE App is installed on armoctl.
• Add the App to the bypass list of org ruleset 70954 (PR required on main). Today the PAT owner's bypass is what lets the bump commit land; without this the push is rejected.

Testing

Not run: needs the prerequisites above. Verify with the next release-labelled merge (or workflow_dispatch): the bump commit should land on main authored via the App, and the release/S3 upload proceed as before.

Docs

Docs-exempt: CI credential swap, no behavior change.

AI Context

Category	Used
Skills	None
MCP Servers	None
Rules/Commands	open_pr

🤖 Generated with Claude Code

AI-skills: none

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}