fix(ci): use declared GH_TOKEN in reusable workflows and valid JSON runner defaults

[sh-waqar]

Two fixes for bugs that affect callers of the shared workflows. Both are small, and the first one needs to land before v1 is moved again.

1. Reusable workflows use an undeclared secret (unreleased, from #264)

#264 (PLT-4224) replaced secrets.GH_TOKEN with secrets.JENKINS_PAT_TOKEN inside six workflow_call workflows:

• frontend-pr-workflow.yml
• frontend-deploy-workflow.yml
• frontend-library-pr-release-workflow.yml
• go-lint-workflow.yaml
• graphql-generate-persisted-operations.yml
• reusable-workflows/frontend-pr-workflow/workflow.yml

None of them declare JENKINS_PAT_TOKEN under on.workflow_call.secrets, so for any caller that passes secrets explicitly it resolves to an empty string. That includes the pattern #264's own README shows: GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }}. Installs from GitHub Packages, Jarvis setup and checkouts that use the token would then fail.

This PR puts secrets.GH_TOKEN back in those six files. Each file is restored to its state just before #264, since #264 is the only commit that has touched them since. #264's caller-side changes, in workflow-templates/* and the READMEs, are kept: callers keep passing JENKINS_PAT_TOKEN in as GH_TOKEN.

How this fits the PLT-4224 migration (not a revert)

The move from the org secret GH_TOKEN to JENKINS_PAT_TOKEN (announcement) happens on the caller side, and that's unchanged here. Inside a reusable workflow, secrets.X only holds what's declared under on.workflow_call.secrets and passed in by the caller. The declared input is GH_TOKEN, so inside these workflows secrets.GH_TOKEN is the name of that input. It isn't the org secret. Callers already pass the new secret into it:

Caller	Passes
demo-app, app-shell, chief	GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }} (migrated)
admin-home, results, auth-page, cha-ching, smart-forms-builder	GH_TOKEN: ${{ secrets.GH_TOKEN }} (not yet migrated)

None of them use secrets: inherit, so secrets.JENKINS_PAT_TOKEN is empty inside these workflows, including for the callers that have already migrated. Once all callers pass JENKINS_PAT_TOKEN, the org GH_TOKEN secret can be deprecated as planned. If you'd like the input itself renamed, that's a breaking change for callers and needs a coordinated follow-up: declare a JENKINS_PAT_TOKEN input, use secrets.JENKINS_PAT_TOKEN || secrets.GH_TOKEN during the transition, then drop GH_TOKEN.

2. Invalid JSON in the frontend-pr-workflow runner defaults

runner defaulted to '[ci-universal-scale-set]', and e2e-runner to '[ci-e2e-scale-set]'. Neither is valid JSON, so fromJSON() fails and the jobs that use them are never created. Callers only work if they override the value; for example demo-app passes '["ci-universal-scale-set"]'. frontend-packages relied on the default, and all 64 of its PR runs failed with no Build or Unit Tests jobs. The deploy and library workflows already quote their defaults. This PR does the same here, and fixes the README examples.

Verified: frontend-packages PR #32 ran green on a commit that includes this fix.

🤖 Generated with Claude Code

https://claude.ai/code/session_019tUHRKTe2YrU4YwTbKzXPH

[sh-waqar]

Tested against a real caller: chief

I ran chief's CI in a throwaway draft PR, Typeform/chief#2161, on two refs of this repo. chief passes GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }}, which is the migrated caller pattern. The PR points pull-request.yml (→ frontend-pr-workflow.yml) and gql-update-allow-list.yml (→ graphql-generate-persisted-operations.yml) at:

1. @main, which includes ci(PLT-4224): replace secrets.GH_TOKEN with secrets.JENKINS_PAT_TOKEN #264 but isn't in v1 yet
2. @fix/reusable-workflow-secrets-and-runner-defaults, which is this PR

Check	@main (#264)	this PR
Generate Persisted Operations	❌ failure	✅ success
🏗️ Build	❌ failure	✅ success
🧪 Unit Tests	❌ failure	✅ success
🔗 Integration Tests	⏭️ skipped (Build failed)	✅ success
🔐 GraphQL Persisted Operations	⏭️ skipped (Build failed)	✅ success
🚀 Deploy Preview	⏭️ skipped (Build failed)	✅ success
🔮 Deep Purple E2E	⏭️ skipped (Build failed)	✅ success
ci-standard-checks (still @v1)	✅	✅

Why @main fails

In every step, GH_TOKEN: shows up blank in the logs instead of ***. secrets.JENKINS_PAT_TOKEN isn't declared under on.workflow_call.secrets, so inside the callee it resolves to an empty string, even though chief passes that secret in as GH_TOKEN.

• Generate Persisted Operations: npm config set '//npm.pkg.github.com/:_authToken' runs with an empty token, and then error Error: https://npm.pkg.github.com/@typeform%2fgenerate-persisted-operations-manifest: authentication token not provided
• Build / Unit Tests: yarn generate fails with Failed to load schema from github:Typeform/graphql-bff#main:generated/schema.graphql, because GraphQL codegen needs GH_TOKEN

Takeaway

This confirms the PR description. As main stands today, moving v1 would break every caller that passes secrets explicitly, including callers that have already migrated. This PR restores secrets.GH_TOKEN, the declared input name, and chief goes green. That matches the PLT-4375 guidance: call-only workflow_call callees keep secrets.GH_TOKEN as the parameter name.

Please merge this before moving v1.

🤖 Generated with Claude Code

[pr-auditor]

✅ Security Analysis Results

No security issues found. 7 files reviewed.

---

@pr-auditor rescan to re-run · Powered by Claude Sonnet 5 · Docs · #security-engineering-team

[musa-1337]

LGTM from the PLT-4224 / migration side.

This matches the callee handoff bug we hit after the early DX batch: #264 renamed secrets.GH_TOKEN → secrets.JENKINS_PAT_TOKEN inside workflow_call callees, but the declared input is still GH_TOKEN. Callers (e.g. chief) correctly pass GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }}; the callee must keep reading secrets.GH_TOKEN.

We later encoded that restore in PLT-4314+ batches. #270 is the right fix for the shared workflows that #264 broke.

Please merge before moving v1.

Also +1 on the runner default JSON fix ('["ci-..."]').