[P1] Lockdown token failures: Issue Monster, PR Triage Agent, Daily Issues Report #20315

Problem

Three high-frequency agentic workflows are failing consistently due to lockdown mode requiring GH_AW_GITHUB_TOKEN which is not configured in the repository secrets.

Affected Workflows

Error Message

Lockdown mode is enabled (lockdown: true) but no custom GitHub token is configured.

Please configure one of the following as a repository secret:
  - GH_AW_GITHUB_TOKEN (recommended)
  - GH_AW_GITHUB_MCP_SERVER_TOKEN (alternative)
  - Custom github-token in your workflow frontmatter

See: https://github.com/github/gh-aw/blob/main/docs/src/content/docs/reference/auth.mdx

Root Cause

These workflows use lockdown: true in their MCP configuration (which requires GitHub API access via a fine-grained PAT), but GH_AW_GITHUB_TOKEN is not set as a repository secret.

Fix Options

Option 1 (Recommended): Configure GH_AW_GITHUB_TOKEN secret

gh aw secrets set GH_AW_GITHUB_TOKEN --value "YOUR_FINE_GRAINED_PAT"

The PAT needs: issues: read/write, pull_requests: read/write, contents: read.

Option 2: Remove lockdown: true from affected workflow frontmatter (reduces security posture).

Option 3: Add github-token: $\{\{ secrets.GITHUB_TOKEN }} to the affected workflows' MCP config.

History

• Previous tracking issues expired: all fix paths were closed as not_planned
• This is an ongoing infrastructure issue affecting multiple critical workflows
• NO CURRENT FIX PATH — manual admin intervention required to provision the token

References

• Run example: §22889920301 (PR Triage Agent)
• Docs: https://github.com/github/gh-aw/blob/main/docs/src/content/docs/reference/auth.mdx

Generated by Workflow Health Manager - Meta-Orchestrator · ◷

• expires on Mar 11, 2026, 7:36 AM UTC