Replace workflow PAT usage with GitHub App authentication

[Evan Mattson (moonbox3)]

Motivation and Context

Semantic Kernel workflows currently depend on the user-scoped GH_ACTIONS_PR_WRITE token for issue labels, pull-request labels, and DevFlow GitHub API writes. Reduced PAT lifetimes make these automations operationally fragile and require frequent manual rotation.

This change introduces the dedicated semantic-kernel-automation GitHub App, installed only on microsoft/semantic-kernel, and uses short-lived installation tokens signed through Azure Key Vault HSM. Fixes #14410.

Description

• Add a reusable composite action that authenticates to Azure through GitHub Actions OIDC, signs the GitHub App JWT through Key Vault without exposing private-key material, and exchanges it for a repository-scoped installation token.
• Mint least-privilege tokens for issue labeling, pull-request labeling, and DevFlow repository operations.
• Migrate label-issues.yml, label-pr.yml, and devflow-pr-review.yml to App-first authentication with the existing PAT retained temporarily as a controlled rollout fallback.
• Keep DevFlow GitHub API writes on the App token while Copilot continues to use the built-in Actions token with copilot-requests: write.
• Add focused JavaScript tests for JWT construction, HSM signature conversion, permission scoping, malformed configuration, and GitHub API failures.

Contribution Checklist

• The code builds clean without any errors or warnings
• The PR follows the SK Contribution Guidelines and the pre-submission formatting script raises no violations
• All unit tests pass, and I have added new tests where possible
• I didn't break anyone 😄

[Copilot]

🟡 Changes recommended

The App authentication path has a critical Azure CLI option error, a missing required content type, and insufficient failure diagnostics.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR replaces PAT-based workflow writes with short-lived GitHub App tokens signed through Azure Key Vault HSM, while retaining controlled fallback authentication.

Changes:

• Adds reusable GitHub App token generation.
• Migrates labeling and DevFlow workflows.
• Adds authentication tests and CI coverage.

File summaries

File	Summary
.github/workflows/label-pr.yml	Uses scoped tokens for pull-request labeling.
.github/workflows/label-issues.yml	Uses scoped tokens for issue labeling.
.github/workflows/github-automation-tests.yml	Runs automation tests in CI.
.github/workflows/devflow-pr-review.yml	Uses App tokens for DevFlow writes.
.github/tests/test_create_github_app_token.js	Tests token generation and validation.
.github/actions/github-app-token/create-token.js	Builds and exchanges GitHub App JWTs; signing, request headers, and error reporting require changes.
.github/actions/github-app-token/action.yml	Defines the reusable authentication action.

Review details

Suppressed comments (2)

.github/actions/github-app-token/create-token.js:134

• This catch discards the underlying failure, so a Key Vault/OIDC error and a GitHub 4xx both appear only as the same generic message; in app-with-fallback mode the workflow then silently proceeds with the PAT warning, making App-auth outages difficult to diagnose. Log a sanitized error.message (without key material) before setting the exit code.

  } catch {
    console.error('GitHub App token generation failed.');
    process.exitCode = 1;

.github/actions/github-app-token/create-token.js:90

• The installation-token POST sends a JSON body but omits Content-Type: application/json. GitHub's access-token endpoint requires this header, so the App path can be rejected before any workflow gets a token; add the header alongside Accept and the API version.

      headers: {
        Accept: 'application/vnd.github+json',
        Authorization: `Bearer ${jwt}`,
        'X-GitHub-Api-Version': '2022-11-28',
      },

• Files reviewed: 7/7 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (1 commit(s)): 3d1957fe165e
Model: gpt-5.6-sol-fast

Overview

This PR replaces long-lived PAT use with repository-scoped GitHub App installation tokens signed through Azure Key Vault, while retaining explicit rollout fallback modes. Fixed permission profiles, base-SHA automation checkouts, disabled credential persistence, masked outputs, fail-closed validation, and focused tests constrain the new authentication path. The review found no supported Critical, High, or Medium defect in the changed behavior.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.