Pass bridge source token to Workbench smoke build

[100yenadmin]

Summary

• pass the existing GH_TOKEN secret into the functional-smoke build so the release-branch bridge packaging script can fetch the private evaos-desktop-bridge source
• add an early smoke-only preflight that fails clearly when the bridge source token is unavailable

Validation

• actionlint .github/workflows/workbench-functional-smoke.yml
• BUN_INSTALL_CACHE_DIR=/Volumes/LEXAR/Codex/.cache/bun bunx oxfmt@0.41.0 --check .github/workflows/workbench-functional-smoke.yml
• git diff --check

Notes

This keeps the public release pipeline out of the debugging loop. The next proof step is to rerun Workbench Functional Smoke against evaos/beta-rc-20260612 and use that staging artifact for Mac pairing proof.

Summary by CodeRabbit

• Chores
  • Updated the workflow to verify required bridge source access credentials are available before any build steps run.
  • Passed the credential to the “build unpacked app only” step via environment variables to ensure access during the build.

[coderabbitai]

📝 Walkthrough

Walkthrough

A preflight bash step is added to the smoke workflow that checks for GH_TOKEN and fails the job if it is absent. The subsequent build step receives EVAOS_DESKTOP_BRIDGE_SOURCE_TOKEN and GH_TOKEN from the same secret via environment variables.

Changes

GH_TOKEN Validation and Bridge Source Token Wiring

Layer / File(s)	Summary
Secret validation and build env .github/workflows/workbench-functional-smoke.yml	Inserts a bash step that validates GH_TOKEN is non-empty and exits non-zero if absent; extends the "Build unpacked app only" step's env block with EVAOS_DESKTOP_BRIDGE_SOURCE_TOKEN and GH_TOKEN both sourced from secrets.GH_TOKEN.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related issues

• P0: Add fast Workbench functional smoke lane before release builds #372: This PR directly implements the token verification step for evaOS desktop bridge source access described in that issue.

Possibly related PRs

• 100yenadmin/evaOS-GUI#375: Modifies the same .github/workflows/workbench-functional-smoke.yml workflow and is the direct predecessor for this GH_TOKEN check and EVAOS_DESKTOP_BRIDGE_SOURCE_TOKEN wiring.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description covers the objectives and validation steps but lacks required template sections like Related Issues, Type of Change, Testing checkboxes, and Screenshots.	Complete the standard PR template by filling in Related Issues, selecting Type of Change, checking Testing boxes, and adding any relevant screenshots or additional context.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title directly and concisely describes the primary change: passing the bridge source token to the Workbench smoke build workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/workbench-functional-smoke-bridge-token-20260622

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/workbench-functional-smoke.yml:
- Around line 123-126: The "Build unpacked app only" step's env section only
forwards EVAOS_DESKTOP_BRIDGE_SOURCE_TOKEN but does not export GH_TOKEN, which
is required by the upstream prepare-aioncore.js script. Add GH_TOKEN to the env
section of the build step by mapping it from secrets.GH_TOKEN, similar to how
EVAOS_DESKTOP_BRIDGE_SOURCE_TOKEN is already configured, to satisfy the
authentication contract expected by the shared build script.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 1eccddf6-8856-4005-b86a-40588757c383

📥 Commits

Reviewing files that changed from the base of the PR and between cb2eb40 and 6317478.

📒 Files selected for processing (1)

• .github/workflows/workbench-functional-smoke.yml

📜 Review details

⏰ Context from checks skipped due to timeout. (6)

• GitHub Check: Build Test (macos-arm64)
• GitHub Check: Build Test (windows-arm64)
• GitHub Check: Build Test (linux)
• GitHub Check: Build Test (windows-x64)
• GitHub Check: Unit Tests (windows-2022)
• GitHub Check: Build Test (macos-x64)

🔇 Additional comments (1)

.github/workflows/workbench-functional-smoke.yml (1)

112-122: LGTM!

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/workbench-functional-smoke.yml (1)

123-127: 🧹 Nitpick | 🔵 Trivial

Add GITHUB_TOKEN to env block as defensive fallback.

The build script (prepare-aioncore.js) explicitly checks both GH_TOKEN and GITHUB_TOKEN (in that order). While the primary path uses gh api which honours GH_TOKEN automatically, a curl fallback exists for scenarios where gh is unavailable. Adding GITHUB_TOKEN ensures the fallback path works without relying on primary path success.

Diff

      - name: Build unpacked app only
        shell: bash
        env:
          EVAOS_DESKTOP_BRIDGE_SOURCE_TOKEN: ${{ secrets.GH_TOKEN }}
          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+         GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/workbench-functional-smoke.yml around lines 123 - 127, Add
GITHUB_TOKEN to the env block in the "Build unpacked app only" step by including
GITHUB_TOKEN: ${{ secrets.GH_TOKEN }} alongside the existing GH_TOKEN and
EVAOS_DESKTOP_BRIDGE_SOURCE_TOKEN environment variables. This ensures that the
curl fallback path in the prepare-aioncore.js script has access to
authentication credentials when the primary gh command path is unavailable.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/workflows/workbench-functional-smoke.yml:
- Around line 123-127: Add GITHUB_TOKEN to the env block in the "Build unpacked
app only" step by including GITHUB_TOKEN: ${{ secrets.GH_TOKEN }} alongside the
existing GH_TOKEN and EVAOS_DESKTOP_BRIDGE_SOURCE_TOKEN environment variables.
This ensures that the curl fallback path in the prepare-aioncore.js script has
access to authentication credentials when the primary gh command path is
unavailable.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 9e30747a-b4dd-4765-b11e-59991259972e

📥 Commits

Reviewing files that changed from the base of the PR and between 6317478 and 9098e34.

📒 Files selected for processing (1)

• .github/workflows/workbench-functional-smoke.yml

📜 Review details

⏰ Context from checks skipped due to timeout. (10)

• GitHub Check: Build Test (windows-arm64)
• GitHub Check: Build Test (macos-arm64)
• GitHub Check: Build Test (linux)
• GitHub Check: Unit Tests (ubuntu-latest)
• GitHub Check: Build Test (windows-x64)
• GitHub Check: Unit Tests (windows-2022)
• GitHub Check: Code Quality
• GitHub Check: Unit Tests (macos-14)
• GitHub Check: Coverage Test
• GitHub Check: Build Test (macos-x64)

🔇 Additional comments (1)

.github/workflows/workbench-functional-smoke.yml (1)

112-122: LGTM!