ci: AUT-1408 replace cicd PAT with GitHub App tokens

[svcnemo-autobot]

Background

cicd-main passed the long-lived secrets.PAT credential into container-build and test actions.

What changed

Mint short-lived GitHub App tokens from vars.BOT_ID and secrets.BOT_KEY in both consuming jobs.

Details

flowchart LR
  ID[BOT_ID] --> Token[Mint app token]
  Key[BOT_KEY] --> Token
  Token --> Build[Container build]
  Token --> Tests[Test action]

Loading

The token action is pinned to immutable v3.2.0. Existing local action input names remain unchanged.

Tested

• pre-commit run --files .github/workflows/cicd-main.yml --show-diff-on-failure --color=never
• Workflow YAML parsing and per-job token-order assertions
• Verified 2 token steps and zero secrets.PAT references
• git diff --check

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[greptile-apps]

Greptile Summary

The workflow replaces a long-lived PAT with short-lived GitHub App tokens in the container-build and GPU-test jobs.

• Adds a pinned actions/create-github-app-token step to each consuming job.
• Sources App credentials from vars.BOT_ID and secrets.BOT_KEY.
• Preserves the existing local-action PAT input interface while passing the generated token.

Confidence Score: 5/5

The PR appears safe to merge with no actionable failures identified in the changed workflow.

The generated tokens are created before both consuming steps, and the existing local-action input contracts remain intact; repository context shows those token inputs currently do not drive an operation requiring broader scope or a longer credential lifetime.

Important Files Changed

Filename	Overview
.github/workflows/cicd-main.yml	Replaces two PAT references with independently minted, short-lived GitHub App tokens; no actionable defect was identified.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  ID[vars.BOT_ID] --> BUILD_TOKEN[Mint build-job token]
  KEY[secrets.BOT_KEY] --> BUILD_TOKEN
  BUILD_TOKEN --> BUILD[build-container PAT input]
  ID --> TEST_TOKEN[Mint test-job token]
  KEY --> TEST_TOKEN
  TEST_TOKEN --> TEST[test-template PAT input]

Loading

_{Reviews (1): Last reviewed commit: "ci: AUT-1408 replace cicd PAT with GitHu..." | Re-trigger Greptile}

[svcnvidia-nemo-ci]

/ok to test a0d521e