feat(health): report workflows that run under a personal token

Read each active workflow file on every tracked branch and flag any secret
other than GITHUB_TOKEN. Automation running under a personal token got a
maintainer's account suspended; this makes it visible the day it returns.

Disabled workflows are skipped, so turning one off in the Actions settings
clears the finding. A repository that genuinely needs another secret lists
it under allowed_secrets in repos.json.

The tests also pin TechMachine's own workflows and the generated satellite
workflows to GITHUB_TOKEN only.

Author: Seungpyo1007

README.md

@@ -20,6 +20,13 @@ It queries each workflow separately rather than scanning "the last N runs",
 because weekly jobs scroll out of any fixed window behind the daily ones — and
 the weekly jobs are the ones that go quiet.
 
+It also reads each active workflow file and reports any that uses a secret
+other than `GITHUB_TOKEN`. Automation here must act as `github-actions[bot]`,
+never as a person: workflows running under a personal token are how a
+maintainer's account got suspended. Disabling the workflow in the Actions
+settings clears the finding; a non-token secret a repository genuinely needs
+goes in that repository's `allowed_secrets` in `repos.json`.
+
 ```bash
 python -m machine.health            # print the report
 python -m machine.health --issue    # also update the issue (needs GITHUB_TOKEN)

machine/health.py

@@ -14,6 +14,7 @@
 import argparse
 import json
 import os
+import re
 import sys
 import urllib.error
 import urllib.request
@@ -29,6 +30,12 @@
 # `cancelled` and `timed_out` included, because that is how silent failures look.
 HEALTHY = {"success", "skipped", "neutral"}
 
+# Automation must act as github-actions[bot], never as a person. Any other
+# secret in an active workflow is usually a personal token, and automation
+# running under one got a maintainer's account suspended.
+SECRET = re.compile(r"secrets\.(\w+)")
+BUILTIN_TOKEN = "GITHUB_TOKEN"
+
 
 @dataclass
 class Finding:
@@ -45,6 +52,26 @@ def _get(url: str, token: str | None) -> Any:
         return json.loads(response.read().decode("utf-8"))
 
 
+def _get_text(url: str, token: str | None) -> str:
+    request = urllib.request.Request(url, headers={"Accept": "application/vnd.github.raw+json"})
+    if token:
+        request.add_header("Authorization", f"Bearer {token}")
+    with urllib.request.urlopen(request, timeout=30) as response:
+        return response.read().decode("utf-8")
+
+
+def foreign_secrets(workflow_text: str, allowed: set[str] = frozenset()) -> list[str]:
+    """Secrets a workflow uses other than the built-in token (and any allowed)."""
+    return sorted(set(SECRET.findall(workflow_text)) - {BUILTIN_TOKEN} - allowed)
+
+
+def token_finding(where: str, workflow_text: str, url: str, allowed: set[str] = frozenset()) -> Finding | None:
+    names = foreign_secrets(workflow_text, allowed)
+    if not names:
+        return None
+    return Finding(where, f"uses {', '.join(names)} — automation must not run as a person", url)
+
+
 def latest_runs(runs: list[dict[str, Any]]) -> dict[str, dict[str, Any]]:
     """Newest completed run per workflow name. `runs` arrive newest first."""
     newest: dict[str, dict[str, Any]] = {}
@@ -69,10 +96,34 @@ def endpoint_finding(name: str, url: str, expect: str, body: Any) -> Finding | N
     return None
 
 
+def workflow_token_findings(repo: str, branch: str, workflow: dict[str, Any],
+                            token: str | None, allowed: set[str]) -> list[Finding]:
+    """Flag an active workflow that reads a secret other than GITHUB_TOKEN.
+
+    Only active workflows count: disabling one in the Actions settings is
+    enough to stop it acting, and clears the finding.
+    """
+    path = workflow.get("path", "")
+    if not path.startswith(".github/workflows/"):
+        return []  # dynamic workflows such as pages-build-deployment have no file
+    where = f"{repo}@{branch} · {workflow['name']}"
+    try:
+        text = _get_text(f"{API}/repos/{repo}/contents/{path}?ref={branch}", token)
+    except urllib.error.HTTPError as exc:
+        if exc.code == 404:
+            return []  # the file is not on this branch
+        return [Finding(where, f"could not read workflow file: {exc}")]
+    except urllib.error.URLError as exc:
+        return [Finding(where, f"could not read workflow file: {exc}")]
+    finding = token_finding(where, text, f"https://github.com/{repo}/blob/{branch}/{path}", allowed)
+    return [finding] if finding else []
+
+
 def check(config: dict[str, Any], token: str | None) -> list[Finding]:
     findings: list[Finding] = []
     for repo in config["repos"]:
         name = repo["name"]
+        allowed = set(repo.get("allowed_secrets", []))
         try:
             workflows = _get(f"{API}/repos/{name}/actions/workflows?per_page=100", token)
         except urllib.error.URLError as exc:
@@ -92,6 +143,7 @@ def check(config: dict[str, Any], token: str | None) -> list[Finding]:
                     runs.extend(_get(url, token).get("workflow_runs", []))
                 except urllib.error.URLError as exc:
                     findings.append(Finding(f"{name} · {workflow['name']}", f"could not read runs: {exc}"))
+                findings.extend(workflow_token_findings(name, branch, workflow, token, allowed))
             findings.extend(run_findings(name, branch, runs))
 
     for endpoint in config["endpoints"]:

tests/test_health.py

@@ -84,3 +84,31 @@ def test_fingerprint_ignores_order_and_links():
     a = [Finding("x", "failure", "https://run/1"), Finding("y", "cancelled", "https://run/2")]
     b = [Finding("y", "cancelled", "https://run/9"), Finding("x", "failure", "https://run/8")]
     assert fingerprint(a) == fingerprint(b)
+
+
+# --- automation must not run as a person -----------------------------------
+
+from pathlib import Path  # noqa: E402
+
+from machine.health import foreign_secrets, token_finding  # noqa: E402
+
+ROOT = Path(__file__).resolve().parent.parent
+
+
+def test_personal_token_is_a_problem():
+    text = "token: ${{ secrets.TECHENGINEBOT_TOKEN || secrets.TECHAPI_TOKEN }}"
+    finding = token_finding("org/repo@main · weekly-ingest", text, "https://x")
+    assert finding and "TECHAPI_TOKEN" in finding.what and "TECHENGINEBOT_TOKEN" in finding.what
+
+
+def test_builtin_token_is_fine():
+    assert token_finding("w", "GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}", "https://x") is None
+
+
+def test_allowed_secret_is_fine():
+    assert foreign_secrets("${{ secrets.SOME_API_KEY }}", {"SOME_API_KEY"}) == []
+
+
+def test_techmachine_itself_uses_only_the_builtin_token():
+    for path in sorted((ROOT / ".github" / "workflows").glob("*.yml")):
+        assert foreign_secrets(path.read_text(encoding="utf-8")) == [], path

tests/test_new_satellite.py

@@ -58,3 +58,11 @@ def test_refuses_to_overwrite(generated: Path):
 def test_unknown_placeholder_is_an_error():
     with pytest.raises(KeyError):
         render("{{nope}}", {})
+
+
+def test_generated_workflows_use_only_the_builtin_token(generated: Path):
+    from machine.health import foreign_secrets
+    workflows = sorted((generated / ".github" / "workflows").glob("*.yml"))
+    assert workflows
+    for path in workflows:
+        assert foreign_secrets(path.read_text(encoding="utf-8")) == [], path