fix(security): move maintainer GitHub tokens behind capability files

[seonghobae]

Purpose

Advance #111 with a bounded test-first security slice that removes direct Maintainer App bearer-token reads from both Noema GitHub automation scripts covered by this lane. scripts/main-governance-audit.mjs and scripts/hourly-commercial-readiness.mjs now receive only a non-secret NOEMA_MAINTAINER_TOKEN_PATH; the short-lived bearer token is staged by trusted workflow bootstrap shell into an ephemeral runner-temp capability file and passed only to the minimal gh subprocess environment.

Fresh source identity

• protected main immediately before this metadata update: 1f4964fb3102cc1b0a9bcf19acae461904ecc672;
• branch: fix/github-token-capability-ingress-1f4964;
• exact head: cd4288300e3753b9ae635d8d3b67b0f663c0544d;
• fresh compare: 13 commits ahead / 0 behind, merge base exactly protected main;
• formal reviews: 0; review threads: 0 at the final pre-update refetch.

Test-first construction

• 0223c6291a9161c428b46275eb93187520238a4e introduced the initial RED credential-ingress contract while protected source still read process.env.GH_TOKEN and workflow callers injected GH_TOKEN directly.
• scripts/lib/delegated-github-token.mjs centralizes fail-closed capability-file loading and rejects missing, unreadable, empty, or control-bearing token bytes.
• scripts/main-governance-audit.mjs resolves NOEMA_MAINTAINER_TOKEN_PATH, reads the token through that capability, and passes it only to the bounded gh subprocess environment.
• A second RED assertion at 3d1c2e0d8b5c076170208aec1b39e6c412b632bd extended the contract to scripts/hourly-commercial-readiness.mjs; production source then removed its process.env.GH_TOKEN read and uses the same capability reader.
• .github/workflows/hourly-commercial-readiness.yml bootstraps capability files for both the governance pre-write audit and the exact-head commercial loop.
• .github/workflows/maintainer-app-readiness.yml does the same for the governance audit and no-write commercial-loop preflight, while retaining the existing capability-file boundary for the Maintainer App readiness evaluator.
• focused tests cover helper success/failure modes, both scripts' absence of process.env.GH_TOKEN, bounded subprocess-environment construction, and the workflow credential-consumer contract.
• pre-existing workflow/toolchain tests that intentionally asserted direct GH_TOKEN injection were updated to assert the new delegated capability contract instead of weakening or deleting those checks.

One Contents API test update initially returned GitHub 409 Timed out validating rule; a fresh refetch proved the branch had not moved, and the same bounded update succeeded on retry. That transient control-plane failure remains execution evidence and is not treated as validation proof.

Security boundary

This PR does not claim the runner-temp capability file is an organization-wide KV or long-term secret store. The GitHub App action necessarily yields the short-lived token to trusted bootstrap shell; the Node automation scripts no longer source that bearer token directly from their ambient process environment. The helper rejects malformed capability contents and only the minimal gh child environment receives GH_TOKEN.

No central .github, naruon, contextual-orchestrator, branch protection, reviewer authority, release, deployment, outbound license, or external secret state is modified. Issue #111 may still contain broader credential-registry/KV work outside these two Noema automation scripts and should not be closed merely because this slice integrates.

Acceptance boundary

Keep Draft until the unchanged exact head has fresh terminal-success application ci, reviewer-ci, protected-base-eligible central Security Scan, exact 100% owned production statement/branch/function/line coverage, and zero valid unresolved findings. Pending/queued/skipped/absent/neutral/failed/cancelled/stale/predecessor/status-only/model-only/rate-limited evidence is non-passing. No predecessor evidence transfers.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8c7ae292-2140-4ff3-9487-07aa2d50ddd4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}