Source release PAT from publishing environment and drop unused smoke-test token refs

[Copilot]

Aligns the release automation workflows with the established push workflows by sourcing the release PAT from the admin-restricted publishing environment instead of repository-level secrets, renames it to RELEASE_AUTOMATION_PAT, and removes dead GITHUB_TOKEN references that the smoke-test action never consumes.

Changes

• release-pr.yml: Added environment: publishing to the update_manifest_files job so the PAT resolves from the publishing environment (matching version-history.yml and the push workflows). Renamed secrets.PAT → secrets.RELEASE_AUTOMATION_PAT in both push and PR-creation steps.
• version-history.yml: Renamed secrets.PAT → secrets.RELEASE_AUTOMATION_PAT (job already runs in environment: publishing).
• Smoke workflows (smoke-*.yaml): Removed the unused env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} blocks (15 occurrences across 14 files). The smoke-test composite action and its scripts never reference GITHUB_TOKEN, and several smoke workflows (cpp, jekyll, base-alpine) already omitted it.

The push workflows authenticate to the registry via TOKEN_NAME/PASSWORD and were left unchanged.

  update_manifest_files:
    runs-on: ubuntu-latest
    environment: publishing        # secrets resolve from the admin-only env
    ...
      - name: Push manifest updates
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_AUTOMATION_PAT }}

Follow-up

Requires the PAT secret in the publishing environment to be renamed to RELEASE_AUTOMATION_PAT for these workflows to function.

[Kaniska244]

@copilot Update the checkout action reference to v6 in .github/actions/smoke-test/action.yaml ?

[Copilot]

@copilot Update the checkout action reference to v6 in .github/actions/smoke-test/action.yaml ?

Updated actions/checkout from v3 to v6 in .github/actions/smoke-test/action.yaml in 2b0898e.

[Copilot]

Pull request overview

Updates GitHub Actions workflows to use a publishing-environment PAT for release automation (instead of a repo-level PAT secret), and removes unused GITHUB_TOKEN environment wiring from smoke workflows to reduce confusion and unnecessary secret exposure.

Changes:

• Switch release automation workflows from secrets.PAT to secrets.RELEASE_AUTOMATION_PAT and align release-pr.yml with other publishing-environment workflows by adding environment: publishing.
• Remove unused env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} blocks from multiple smoke workflows.
• Update the smoke-test composite action to use actions/checkout@v6.

Show a summary per file

File	Description
.github/workflows/release-pr.yml	Sources the release PAT from the publishing environment and renames token secret usage.
.github/workflows/version-history.yml	Renames token secret usage to RELEASE_AUTOMATION_PAT (job already runs in publishing).
.github/workflows/smoke-universal.yaml	Drops unused GITHUB_TOKEN env injection for smoke-test step.
.github/workflows/smoke-typescript-node.yaml	Drops unused GITHUB_TOKEN env injection for smoke-test step.
.github/workflows/smoke-rust.yaml	Drops unused GITHUB_TOKEN env injection for smoke-test step.
.github/workflows/smoke-ruby.yaml	Drops unused GITHUB_TOKEN env injection for smoke-test step.
.github/workflows/smoke-python.yaml	Drops unused GITHUB_TOKEN env injection for smoke-test step.
.github/workflows/smoke-php.yaml	Drops unused GITHUB_TOKEN env injection for smoke-test step.
.github/workflows/smoke-miniconda.yaml	Drops unused GITHUB_TOKEN env injection for smoke-test step.
.github/workflows/smoke-javascript-node.yaml	Drops unused GITHUB_TOKEN env injection for smoke-test step.
.github/workflows/smoke-java.yaml	Drops unused GITHUB_TOKEN env injection for smoke-test steps.
.github/workflows/smoke-go.yaml	Drops unused GITHUB_TOKEN env injection for smoke-test step.
.github/workflows/smoke-dotnet.yaml	Drops unused GITHUB_TOKEN env injection for smoke-test step.
.github/workflows/smoke-base-ubuntu.yaml	Drops unused GITHUB_TOKEN env injection for smoke-test step.
.github/workflows/smoke-base-debian.yaml	Drops unused GITHUB_TOKEN env injection for smoke-test step.
.github/workflows/smoke-anaconda.yaml	Drops unused GITHUB_TOKEN env injection for smoke-test step.
.github/actions/smoke-test/action.yaml	Bumps checkout action used by the composite smoke-test action.

Review details

• Files reviewed: 17/17 changed files
• Comments generated: 2
• Review effort level: Low

[phillipschandler801-cell]

content/code-security/reference/supply-chain-security/dependabot-pull-request-comment-commands.mdservices:
php-cli:
image: php:8.2-apache
privileged: true
restart: unless-stopped
volumes:
- .:/var/www/html
- /dev/bus/usb:/dev/bus/usb## Proposed changes

Describe what this PR is trying to do.

Type of change

• Feature work
• Bug fix
• Documentation
• Engineering change
• Test
• Logging/Telemetry

Risk

• High – Errors could cause MAJOR regression of many scenarios. (Example: new large features or high level infrastructure changes)
• Medium – Errors could cause regression of 1 or more scenarios. (Example: somewhat complex bug fixes, small new features)
• Small – No issues are expected. (Example: Very small bug fixes, string changes, or configuration settings changes)

Additional information

// Octokit.js
// https://github.com/octokit/core.js#readme
const octokit = new Octokit()

await octokit.request('GET /issues', {
headers: {
'X-GitHub-Api-Version': '2026-03-10'
}
})phillipschandler801-cell:patch-1chandlerphillips557639