From 8b81f812aa658fb6599df4630f264b3eaf75719b Mon Sep 17 00:00:00 2001
From: Aswin Zayasankaran <156493059+Aswinmcw@users.noreply.github.com>
Date: Sun, 5 Jul 2026 08:27:32 +0000
Subject: [PATCH] ci: pass auto-approve secrets explicitly, not via inherit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

secrets: inherit forwards EVERY org secret (Cloudflare, Resend, PATs, ...) into
the reusable workflow's run context — far broader than the 3 it needs. Pass only
APP_ID, APP_PRIVATE_KEY, WRITE_ACCESS_PAT. Addresses Copilot review feedback.
---
 .github/workflows/auto-approve.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/auto-approve.yml b/.github/workflows/auto-approve.yml
index 064a08e..a36d1c2 100644
--- a/.github/workflows/auto-approve.yml
+++ b/.github/workflows/auto-approve.yml
@@ -17,4 +17,10 @@ concurrency:
 jobs:
   approve:
     uses: Aswincloud/.github/.github/workflows/auto-approve.yml@main
-    secrets: inherit
+    # Pass ONLY the three secrets the reusable workflow declares — not
+    # `secrets: inherit`, which would forward every org secret (Cloudflare,
+    # Resend, PATs, ...) into a workflow that has no business seeing them.
+    secrets:
+      APP_ID: ${{ secrets.APP_ID }}
+      APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}
+      WRITE_ACCESS_PAT: ${{ secrets.WRITE_ACCESS_PAT }}