Durably document required secrets

[edburns]

Fixes #2045

@MackinnonBuck wrote:

I just attempted to publish an SDK prerelease and the Java step failed. It seems the token used for publishing the Java SDK might have expired? Publish SDK packages · github/copilot-sdk@1f5516e

Will install a new one and ping you back.

I will also ensure the documentation for this dependency is updated.

[Copilot]

Pull request overview

Adds a maintainer-facing inventory of GitHub Actions secrets, their purposes, and affected workflows.

Changes:

• Documents SDK testing and agentic workflow secrets.
• Documents Java and Rust publishing credentials.
• Links to secret-management resources.

Show a summary per file

File	Description
docs/developer-docs/secrets.md	Adds the repository secrets-management guide.

Review details

Comments suppressed due to low confidence (4)

docs/developer-docs/secrets.md:26

• These two workflow lists are broader than the actual usage. Both secrets occur in the 11 generated .lock.yml workflows, but neither java-codegen-check.yml nor java-smoke-test.yml references them; those two only use COPILOT_GITHUB_TOKEN. Avoid documenting secrets as required for workflows that do not consume them.

* **`GH_AW_GITHUB_TOKEN`**: GitHub token used by the gh-aw runtime for workflow orchestration.
  * Workflows: same as `COPILOT_GITHUB_TOKEN` above

* **`GH_AW_GITHUB_MCP_SERVER_TOKEN`**: Token used by the GitHub MCP server container within agentic workflows.
  * Workflows: same as `COPILOT_GITHUB_TOKEN` above

docs/developer-docs/secrets.md:31

• Read access alone is insufficient for this token. cross-repo-issue-analysis.md also supplies it to the GitHub tool and safe outputs, which add labels to the triggering SDK issue and create a linked issue in github/copilot-agent-runtime. A replacement token provisioned from this description would fail those writes.

* **`RUNTIME_TRIAGE_TOKEN`**: Token with read access to `github/copilot-agent-runtime`. Used to clone that repository for cross-repo issue analysis.

docs/developer-docs/secrets.md:42

• The Java build uses the Central Publishing plugin and central.sonatype.com, not the legacy OSSRH service. Calling these OSSRH credentials can send maintainers to the wrong credential system when rotating the token that motivated this PR.

* **`JAVA_MAVEN_CENTRAL_USERNAME`**: Username for Maven Central (Sonatype OSSRH) authentication.
  * Workflows: `java-publish-maven.yml`, `java-publish-snapshot.yml`

* **`JAVA_MAVEN_CENTRAL_PASSWORD`**: Password or token for Maven Central (Sonatype OSSRH) authentication.
  * Workflows: `java-publish-maven.yml`, `java-publish-snapshot.yml`

docs/developer-docs/secrets.md:53

• This token also dispatches deploy-site.yml in github/copilot-sdk-java (java-publish-maven.yml:328-345), so Actions permission only on this repository is not enough. The workflow's preflight checks only the local changelog dispatch, meaning an incorrectly scoped replacement can pass preflight and then fail after publishing. Document both repositories and the classic-PAT equivalent.

* **`JAVA_RELEASE_GITHUB_TOKEN`**: GitHub token with **workflow dispatch** (actions:write) permission. Used to trigger the `release-changelog.lock.yml` workflow after a release is published.

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Medium

[Copilot]

Review details

Comments suppressed due to low confidence (1)

docs/developer-docs/secrets.md:41

• This likewise directs maintainers to obsolete OSSRH credentials, which cannot authenticate the Central Portal workflow used here. Document the password half of a Maven Central Portal user token instead.

* **`JAVA_MAVEN_CENTRAL_PASSWORD`**: Password or token for Maven Central (Sonatype OSSRH) authentication.

• Files reviewed: 1/1 changed files
• Comments generated: 2
• Review effort level: Medium

[Copilot]

Review details

Comments suppressed due to low confidence (1)

docs/developer-docs/secrets.md:41

• This points maintainers at the retired OSSRH credential system, while both release and snapshot publishing use the Maven Central Portal (central-publishing-maven-plugin and https://central.sonatype.com/repository/maven-snapshots/). The value is the password generated alongside the username by the Portal user token; labeling it OSSRH can lead to rotating the wrong credential.

* **`JAVA_MAVEN_CENTRAL_PASSWORD`**: Password or token for Maven Central (Sonatype OSSRH) authentication.

• Files reviewed: 1/1 changed files
• Comments generated: 0 new
• Review effort level: Medium

[Copilot]

Review details

Comments suppressed due to low confidence (2)

docs/developer-docs/secrets.md:20

• The agentic workflows no longer use this repository secret for inference. Their source grants copilot-requests: write, and the compiled jobs execute Copilot with ${{ github.token }} and S2STOKENS: true; secrets.COPILOT_GITHUB_TOKEN only appears in the OAuth-token validation step. Keeping all lock workflows in this list tells maintainers to retain an unused credential. Limit this entry to the two Java workflows that actually pass the secret to Copilot.

* **`COPILOT_GITHUB_TOKEN`**: GitHub OAuth token consumed by the Copilot CLI for AI authentication. Required by all agentic workflows when invoking `copilot` for AI inference.
  * Workflows: `issue-triage.lock.yml`, `issue-classification.lock.yml`, `handle-bug.lock.yml`, `handle-enhancement.lock.yml`, `handle-question.lock.yml`, `handle-documentation.lock.yml`, `java-codegen-check.yml`, `java-codegen-fix.lock.yml`, `java-smoke-test.yml`, `java-adapt-handwritten-code-to-accept-upgrade-changes.lock.yml`, `release-changelog.lock.yml`, `sdk-consistency-review.lock.yml`, `cross-repo-issue-analysis.lock.yml`

docs/developer-docs/secrets.md:41

• This points maintainers at the legacy OSSRH credential type, while the workflow and java/pom.xml use the Central Portal (org.sonatype.central:central-publishing-maven-plugin and central.sonatype.com). The password must be the password generated as part of the same Central Portal user-token pair described above; OSSRH credentials may fail authentication.

* **`JAVA_MAVEN_CENTRAL_PASSWORD`**: Password or token for Maven Central (Sonatype OSSRH) authentication.

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Medium

[Copilot]

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Medium