Skip to content

ci: Update add-team-label and check-template-and-add-labels workflows to use OIDC token exchange cp-7.80.0#30840

Merged
Mrtenz merged 7 commits into
mainfrom
mrtenz/token-exchange
Jun 1, 2026
Merged

ci: Update add-team-label and check-template-and-add-labels workflows to use OIDC token exchange cp-7.80.0#30840
Mrtenz merged 7 commits into
mainfrom
mrtenz/token-exchange

Conversation

@Mrtenz

@Mrtenz Mrtenz commented Jun 1, 2026

Copy link
Copy Markdown
Member

Description

This updates the add-team-label and check-template-and-add-labels workflows to use OIDC token exchange.

Changelog

CHANGELOG entry:

Related issues

Fixes:

Manual testing steps

Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]

Screenshots/Recordings

Before

After

Pre-merge author checklist

Performance checks (if applicable)

  • I've tested on Android
    • Ideally on a mid-range device; emulator is acceptable
  • I've tested with a power user scenario
    • Use these power-user SRPs to import wallets with many accounts and tokens
  • I've instrumented key operations with Sentry traces for production performance metrics

For performance guidelines and tooling, see the Performance Guide.

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Note

Medium Risk
Changes how automation authenticates to GitHub (and planning); misconfiguration could break PR/issue labeling until tokens and permissions are correct.

Overview
Two GitHub Actions workflows now obtain GitHub API tokens through OIDC token exchange (MetaMask/github-tools get-token@v1 and vars.TOKEN_EXCHANGE_URL) instead of repository secrets (TEAM_LABEL_TOKEN, LABEL_TOKEN).

add-team-label grants id-token: write, mints a read-only token for MetaMask/MetaMask-planning, a separate token with pull_requests: write, and passes both into add-team-label@v1 as planning-token and team-label-token.

check-template-and-add-labels adds contents: read and id-token: write, fetches a scoped token (issues: write, members: read, pull_requests: write), and wires LABEL_TOKEN to that output for the existing script step.

Reviewed by Cursor Bugbot for commit b51e09a. Bugbot is set up for automated code reviews on this repo. Configure here.

@github-actions github-actions Bot added the size-S label Jun 1, 2026
@mm-token-exchange-service mm-token-exchange-service Bot added the team-core-platform Core Platform team label Jun 1, 2026
@Mrtenz Mrtenz added the no-changelog no-changelog Indicates no external facing user changes, therefore no changelog documentation needed label Jun 1, 2026
@Mrtenz Mrtenz marked this pull request as ready for review June 1, 2026 13:55
@Mrtenz Mrtenz requested a review from a team as a code owner June 1, 2026 13:55
@github-actions github-actions Bot added the risk:low AI analysis: low risk label Jun 1, 2026

@cursor cursor Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 2 potential issues.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 1e9225a. Configure here.

Comment thread .github/workflows/check-template-and-add-labels.yml
Comment thread .github/workflows/add-team-label.yml
@github-actions github-actions Bot added risk:medium AI analysis: medium risk and removed risk:low AI analysis: low risk labels Jun 1, 2026
@tommasini tommasini changed the title ci: Update add-team-label and check-template-and-add-labels workflows to use OIDC token exchange ci: Update add-team-label and check-template-and-add-labels workflows to use OIDC token exchange cp-7.80.0 Jun 1, 2026
@Mrtenz Mrtenz enabled auto-merge June 1, 2026 14:17
@Mrtenz Mrtenz added this pull request to the merge queue Jun 1, 2026
Merged via the queue into main with commit 14486dc Jun 1, 2026
104 of 109 checks passed
@Mrtenz Mrtenz deleted the mrtenz/token-exchange branch June 1, 2026 14:42
@github-actions github-actions Bot locked and limited conversation to collaborators Jun 1, 2026
@metamaskbotv2 metamaskbotv2 Bot added the release-7.81.0 Issue or pull request that will be included in release 7.81.0 label Jun 1, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

no-changelog no-changelog Indicates no external facing user changes, therefore no changelog documentation needed release-7.81.0 Issue or pull request that will be included in release 7.81.0 risk:medium AI analysis: medium risk size-S team-core-platform Core Platform team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants