ci(PLT-4267): replace secrets.GH_TOKEN with secrets.JENKINS_PAT_TOKEN

[tf-seti]

Why

We are deprecating the org-level GitHub Actions / Dependabot secret GH_TOKEN and standardizing on JENKINS_PAT_TOKEN.

Context (PLT-4267):

• GH_TOKEN is a legacy org secret name that is easy to confuse with GitHub's built-in default token (secrets.GITHUB_TOKEN / github.token).
• The underlying credential is the jenkins-tf service account PAT, used for CI tasks such as private package installs, Dependabot auth, and other automation that needs a stable org-scoped token.
• SRE has created JENKINS_PAT_TOKEN as the replacement org secret with clearer ownership and naming. The old GH_TOKEN will be revoked after org-wide migration is complete.

Why this change matters:

• Makes it obvious which PAT is in use (JENKINS_PAT_TOKEN → jenkins-tf)
• Reduces risk of mixing custom PATs with the default GITHUB_TOKEN
• Enables safe deprecation and rotation of the old secret

What changed

• secrets.GH_TOKEN → secrets.JENKINS_PAT_TOKEN in:
  • .github/workflows/**
  • Dependabot config (.github/dependabot.yml / .yaml, and root-level dependabot.yml / .yaml)
  • Nested workflow paths (cookiecutter / generator templates)
  • templates/*.yml workflow templates where applicable
  • Markdown docs referencing the secret (where applicable)
• Unchanged: left-hand env names such as GH_TOKEN: and GITHUB_TOKEN: — only the secret reference on the right is updated.

What we did not change

• secrets.GITHUB_TOKEN / built-in github.token (default GitHub Actions token)
• ATLANTIS_GH_TOKEN or other unrelated secrets
• Jenkins SSM/JCasC github_token configuration

Test plan

• CI still authenticates (checkout, private packages, PR comments, etc. as applicable)
• Dependabot still authenticates where Dependabot config was updated
• No token values appear in workflow logs

Rollback

While org GH_TOKEN still exists, revert this PR to restore secrets.GH_TOKEN if needed.

Created by Sourcegraph batch change muhammad.sayed/plt-4267-gh-token-integrations.

[pr-auditor]

✅ Security Analysis Results

No security issues found. 3 files reviewed.

---

@pr-auditor rescan to re-run · Powered by Claude Sonnet 5 · Docs · #security-engineering-team