ci: route HF_TOKEN-using jobs through approved-workflow environment

[adobrzyn]

Summary

Adds environment: approved-workflow to every job that consumes secrets.HF_TOKEN across the three CI workflows. Together with the existing approval gate in pre-merge-trigger.yaml (environment: pre-merge-approval, added in #1471), this completes the two-layer protection model:

PR opened
  -> pre-merge-trigger `gate` job: pauses for required reviewer (approval #1)
  -> on approval, pre-merge.yaml is dispatched
  -> downstream secret-using jobs resolve HF_TOKEN from the
     `approved-workflow` environment (no second per-job approval)

Why

With HF_TOKEN previously at repo-secret scope, any matrix entry of any e2e/test job had direct access the moment CI started. The recent malicious fork PR exfiltrated it via an auto-discovered run_* function. After this change, the token is only released from a GitHub Environment that a maintainer-controlled deployment-branch rule restricts to main / releases/**, and only after the upstream gate has approved the dispatch.

We deliberately add the environment only on jobs that actually use the secret (15 jobs). Helper jobs (gatekeeper, discover_*, retrieve_*, pre-commit, post-comment, cleanup_*, build_nixl_dockerfile, check_dockerfile_changes, prepare-release-branch, summarize_and_notify, setup_and_build, store_last_stable_vllm_commit) do not touch HF_TOKEN and are not modified, to avoid pointless extra gate evaluations.

Affected jobs (15)

• pre-merge.yaml: hpu_unit_tests, hpu_pd_tests, hpu_perf_tests, hpu_dp_tests, e2e, calibration_tests
• hourly-ci.yaml: run_unit_tests, e2e, run_data_parallel_test, run_pd_disaggregate_test
• create-release-branch.yaml: run_unit_tests, e2e, run_data_parallel_test, run_pd_disaggregate_test, run_hpu_perf_tests

Diff

+15 lines, 0 deletions. Each touched job gets exactly one new line: environment: approved-workflow, inserted immediately after runs-on:.

Required repo configuration (before this PR can be merged safely)

1. Settings → Environments → create environment approved-workflow.
2. Add HF_TOKEN as an environment secret (the rotated value).
3. No required reviewers on this environment (the upstream pre-merge-approval gate already enforces approval; adding reviewers here would prompt once per job).
4. Deployment branches and tags: Selected branches → main, releases/**. Prevents a fork PR from claiming the environment from a non-trusted ref.
5. Delete HF_TOKEN from repository-level secrets so the environment value is the only source.

Testing

Validated end-to-end against bmyrcha/vllm-gaudi first using a benign fork PR. With the two environments configured as above, the gate paused as expected, jobs received the secret after approval without a second prompt, and a deliberately mis-authored downstream PR could not reach the secret.

Close-cross-ref: builds on #1471.

[Copilot]

Pull request overview

Routes all GitHub Actions jobs that consume secrets.HF_TOKEN through the approved-workflow GitHub Environment, so the token can be scoped to an environment protected by deployment-branch rules and released only after the upstream approval gate dispatches CI.

Changes:

• Added environment: approved-workflow to each HF_TOKEN-using job in pre-merge.yaml.
• Added environment: approved-workflow to each HF_TOKEN-using job in hourly-ci.yaml.
• Added environment: approved-workflow to each HF_TOKEN-using job in create-release-branch.yaml.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
.github/workflows/pre-merge.yaml	Adds approved-workflow environment to all pre-merge jobs that pass secrets.HF_TOKEN into containers.
.github/workflows/hourly-ci.yaml	Adds approved-workflow environment to hourly CI jobs that pass secrets.HF_TOKEN.
.github/workflows/create-release-branch.yaml	Adds approved-workflow environment to release-branch workflow jobs that pass secrets.HF_TOKEN.