ci: tag with the built-in GITHUB_TOKEN instead of S9_GITHUB_TOKEN

[MusaMisto]

Why

The tag step passed secrets.S9_GITHUB_TOKEN to reusable-service-cicd. That org PAT (last rotated 2025-09-15) now returns HTTP 401. On the next release the tag job would fail and leave the version untagged, and every later run would recompute the same version.

Change

github-token: ${{ secrets.GITHUB_TOKEN }}: the job's built-in token, minted per run, scoped to this repo, and never expiring. The comments are updated to match.

Why this is safe

• Permissions: the tag job only needs contents: write on this repo, which this workflow already grants (permissions: contents: write).
• No tag triggers: no workflow in this repo is triggered by tags, so it doesn't matter that tags created by GITHUB_TOKEN don't start other runs.
• No tag rules: the org has no tag rulesets (all four rulesets target branches).
• Proven elsewhere: the same reusable-service-cicd tag job with github-token: ${{ secrets.GITHUB_TOKEN }} succeeded in Bitween-api today.
• Lint: actionlint is clean.

Can be merged independently of any other PR.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: simplify9/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: b4433c6e-3687-4302-9032-b794f93716ca

📥 Commits

Reviewing files that changed from the base of the PR and between d35c027 and bce1304.

📒 Files selected for processing (1)

• .github/workflows/ci-cd.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (1)

Treat GitHub Actions changes as supply-chain sensitive.

⚙️ CodeRabbit configuration file

Files:

• .github/workflows/ci-cd.yml

🔇 Additional comments (1)

.github/workflows/ci-cd.yml (1)

83-83: 🗄️ Data Integrity & Integration

The concern is refuted. The repository contains no workflow with a create trigger, tag filter, or tag-capable push trigger. The only push trigger is limited to main and releases/*.

---

📝 Summary

• Changed: Tagging now uses secrets.GITHUB_TOKEN instead of secrets.S9_GITHUB_TOKEN. The workflow grants contents: write. The comment says the prior organization PAT expired and returned HTTP 401.
• Risk: risk:low.
• Security-sensitive areas: The change affects the credential used to create tags. The built-in token has write access to repository contents. No other permission changes are shown.
• Test coverage impact: No test configuration changes are shown. The workflow still sets run-tests: 'true'; no test execution results were provided.
• Operational concerns: The author reports that the repository has no workflows triggered by tags. GitHub’s built-in token does not trigger subsequent workflows from its events. Review this assumption if tag-triggered automation is added.

Walkthrough

The CI/CD workflow now uses secrets.GITHUB_TOKEN instead of secrets.S9_GITHUB_TOKEN for tagging. Its comment states that the built-in token has contents: write permission and that the previous PAT expired with HTTP 401.

Changes

Tagging token update

Layer / File(s)	Summary
Update tagging token .github/workflows/ci-cd.yml	The tagging step now uses secrets.GITHUB_TOKEN. The comment identifies its contents: write permission and notes the previous PAT expired with HTTP 401.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Bug fix

Suggested labels: infra, security, risk:critical

Suggested reviewers: mmalkhatib

Merge Risk: ⚪ Minimal · up to bce13

The built-in token can create the release tag in this repository. No concrete merge-blocking issue remains.

Architecture Summary

Architecture risk: 🔵 Low · up to bce13

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/ci-cd.yml: The tagging token changes from secrets.S9_GITHUB_TOKEN to secrets.GITHUB_TOKEN. The accompanying comment says the built-in token has the granted contents: write permission and identifies the previous PAT as expired with HTTP 401; the removed comment said that PAT was used only for tagging and did not need write:packages.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: replacing S9_GITHUB_TOKEN with the built-in GITHUB_TOKEN for tagging.
Description check	✅ Passed	The description explains the expired PAT, the token change, permissions, trigger behavior, validation, and operational impact.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}