add a dryrun check

[scoopex]

No description provided.

[scoopex]

Hint: https://github.com/actions/create-github-app-token

[garloff]

Thanks, Marc

[garloff]

But the github workflows don't pass, so something is not working here yet.

General fix:
Eliminate dynamic secret access and explicitly declare which secrets are used by the workflow. For per-user tokens, enumerate each possible user as a build matrix with a conditional per-user environment variable selection.

Detailed fix:

• Remove the use of secrets[format('GHP_{0}', github.actor)].
• Instead, create a matrix in the job that lists allowed users (actors) and assigns the exact secret name for each one.
• Use a conditional for each possible actor to set the API_TOKEN env variable specifically to the corresponding secret, for example:

  env:
    API_TOKEN: ${{ secrets.GHP_ACTOR1 }}

• Remove any unnecessary checking for whether the secret is present—GitHub will fail with a useful error if a required secret is missing.
• Update the api_token variable in the ansible invocation to use this new env declaration.

File/region to change:
.github/workflows/dryrun-manage-github-repositories.yml

• Replace the dynamic secret access in the relevant env sections with explicit per-actor/secret mapping.

---

To fix the problem, we must avoid dynamically accessing secrets at runtime. Instead, explicitly define input variables or secrets for each possible value of ${{ github.actor }}. This ensures that only the secrets that are needed are passed to the workflow runner.

The best approach is to create a job matrix for each supported actor, and, for each one, pass the correct secret explicitly in the job's env section. For demonstration, if you have a limited set of possible actors (e.g., user1 and user2), you can write two jobs that are conditionally run only for the respective actor by using the if field, and reference the relevant secret explicitly with secrets.GHP_user1 and secrets.GHP_user2.

In practice:

• For each actor who should have a specific PAT, add a job or a step guarded by if: github.actor == 'actorname'.
• Set API_TOKEN: ${{ secrets.GHP_actorname }}.

If there are many actors, you will need to enumerate each one explicitly. If that is not feasible, you should reconsider the workflow design, as dynamic secret access is fundamentally prohibited for security.

Required changes:

• Remove dynamic secret access in lines 21 and 53.
• Replace with explicit secret references for each allowed actor, using conditionals.