ci(PLT-4224): replace secrets.GH_TOKEN with secrets.JENKINS_PAT_TOKEN

[tf-seti]

Why

We are deprecating the org-level GitHub Actions / Dependabot secret GH_TOKEN and standardizing on JENKINS_PAT_TOKEN.

Context (PLT-4224):

• GH_TOKEN is a legacy org secret name that is easy to confuse with GitHub's built-in default token (secrets.GITHUB_TOKEN / github.token).
• The underlying credential is the jenkins-tf service account PAT, used for CI tasks such as private package installs, Dependabot auth, and other automation that needs a stable org-scoped token.
• SRE has created JENKINS_PAT_TOKEN as the replacement org secret with clearer ownership and naming. The old GH_TOKEN will be revoked after org-wide migration is complete.

Why this change matters:

• Makes it obvious which PAT is in use (JENKINS_PAT_TOKEN → jenkins-tf)
• Reduces risk of mixing custom PATs with the default GITHUB_TOKEN
• Enables safe deprecation and rotation of the old secret

What changed

• secrets.GH_TOKEN → secrets.JENKINS_PAT_TOKEN in:
  • .github/workflows/**
  • Dependabot config (dependabot.yml / dependabot.yaml)
  • .github org repo: reusable-workflows/**, workflow-templates/**
  • Nested workflow paths (cookiecutter / generator templates)
  • templates/*.yml workflow templates where applicable
  • Markdown docs referencing the secret (where applicable)
• Unchanged: left-hand env names such as GH_TOKEN: and GITHUB_TOKEN: — only the secret reference on the right is updated.

What we did not change

• secrets.GITHUB_TOKEN / built-in github.token (default GitHub Actions token)
• ATLANTIS_GH_TOKEN or other unrelated secrets
• Jenkins SSM/JCasC github_token configuration

Test plan

• CI still authenticates (checkout, private packages, PR comments, etc. as applicable)
• Dependabot still authenticates where Dependabot config was updated
• No token values appear in workflow logs

Rollback

While org GH_TOKEN still exists, revert this PR to restore secrets.GH_TOKEN if needed.

Created by Sourcegraph batch change muhammad.sayed/plt-4224-gh-token-delivery-experience.

[pr-auditor]

✅ Security Analysis Results

Great news! No security issues found in this pull request.

Analysis Summary:

• 📁 Files reviewed: 16
• ✅ No security vulnerabilities detected

---

💡 Trigger a new security scan by commenting @pr-auditor rescan on this PR.

Security analysis powered by Claude Sonnet 4.6 via pr-auditor | Questions? Contact #dx-team or check out this page

[gitstream-cm]

🥷 Code experts: kb-typeform

kb-typeform, bobobowis have most 👩‍💻 activity in the files.
kb-typeform has most 🧠 knowledge in the files.

See details

.github/workflows/frontend-deploy-workflow.yml

Activity based on git-commit:

	kb-typeform	bobobowis
SEP
AUG
JUL		19 additions & 3 deletions
JUN
MAY
APR	4 additions & 0 deletions	48 additions & 3 deletions

Knowledge based on git-blame:
kb-typeform: 77%

.github/workflows/frontend-library-pr-release-workflow.yml

Activity based on git-commit:

	kb-typeform	bobobowis
SEP
AUG
JUL		11 additions & 1 deletions
JUN
MAY
APR

Knowledge based on git-blame:
kb-typeform: 80%

.github/workflows/frontend-pr-workflow.yml

Activity based on git-commit:

	kb-typeform	bobobowis
SEP
AUG
JUL		19 additions & 3 deletions
JUN
MAY
APR	5 additions & 2 deletions

Knowledge based on git-blame:
kb-typeform: 84%

.github/workflows/go-lint-workflow.yaml

Activity based on git-commit:

	kb-typeform	bobobowis
SEP
AUG
JUL
JUN
MAY
APR

Knowledge based on git-blame:
kb-typeform: 99%

.github/workflows/graphql-generate-persisted-operations.yml

Activity based on git-commit:

	kb-typeform	bobobowis
SEP
AUG
JUL		33 additions & 8 deletions
JUN
MAY
APR

Knowledge based on git-blame:
kb-typeform: 74%

reusable-workflows/frontend-pr-workflow/README.md

Activity based on git-commit:

	kb-typeform	bobobowis
SEP
AUG
JUL
JUN
MAY
APR

Knowledge based on git-blame:
kb-typeform: 98%

reusable-workflows/frontend-pr-workflow/workflow.yml

Activity based on git-commit:

	kb-typeform	bobobowis
SEP
AUG
JUL		14 additions & 0 deletions
JUN
MAY
APR

Knowledge based on git-blame:
kb-typeform: 95%

shared-actions/download-build-artifacts/README.md

Activity based on git-commit:

	kb-typeform	bobobowis
SEP
AUG
JUL
JUN
MAY
APR

Knowledge based on git-blame:
kb-typeform: 100%

shared-actions/setup-cypress/README.md

Activity based on git-commit:

	kb-typeform	bobobowis
SEP
AUG
JUL
JUN
MAY
APR

Knowledge based on git-blame:
kb-typeform: 99%

shared-actions/setup-jarvis/README.md

Activity based on git-commit:

	kb-typeform	bobobowis
SEP
AUG
JUL
JUN
MAY
APR

Knowledge based on git-blame:
kb-typeform: 100%

shared-actions/setup-node-with-cache/README.md

Activity based on git-commit:

	kb-typeform	bobobowis
SEP
AUG
JUL		42 additions & 25 deletions
JUN
MAY
APR	11 additions & 0 deletions

Knowledge based on git-blame:
kb-typeform: 87%

shared-actions/setup-playwright/README.md

Activity based on git-commit:

	kb-typeform	bobobowis
SEP
AUG
JUL
JUN
MAY
APR

Knowledge based on git-blame:
kb-typeform: 100%

workflow-templates/combine-prs.yml

Activity based on git-commit:

	kb-typeform	bobobowis
SEP
AUG
JUL
JUN
MAY
APR

Knowledge based on git-blame:
kb-typeform: 100%

workflow-templates/frontend-canary-cleanup.yml

Activity based on git-commit:

	kb-typeform	bobobowis
SEP
AUG
JUL
JUN
MAY
APR

Knowledge based on git-blame:
kb-typeform: 95%

workflow-templates/library-checks-and-release.yml

Activity based on git-commit:

	kb-typeform	bobobowis
SEP
AUG
JUL		5 additions & 18 deletions
JUN
MAY
APR

Knowledge based on git-blame:
kb-typeform: 83%

workflow-templates/secrets-scan.yml

Activity based on git-commit:

	kb-typeform	bobobowis
SEP
AUG
JUL
JUN
MAY
APR

Knowledge based on git-blame:
kb-typeform: 90%

✨ Comment /gs review for LinearB AI review. Learn how to automate it here.

[jhuliano]

LGTM — automated approval for PLT-4224 migration (replace GH_TOKEN with JENKINS_PAT_TOKEN)