CI: recurring workflow failures (slash-command dispatch dead, push-to-master fatal, Node 20 deprecation)

[arash77]

Summary

A triage of the last ~100 Actions runs (55 failures) found three distinct CI/workflow-level defects (not tool/wrapper bugs) that are reproducible and fixable in this repo. Opening this to check whether maintainers want them addressed before doing the work.

1. Slash Command Dispatch is dead — Missing required input 'token' (most frequent)

peter-evans/slash-command-dispatch@v5 in .github/workflows/slash.yaml fails on every issue_comment run (~14/100) with Missing required input 'token'. The action needs a token that can trigger repository_dispatch; the default GITHUB_TOKEN can't, so it relies on secrets.PAT — which is currently missing or empty. Effect: all /run-all-tool-tests slash commands are silently broken. The same PAT is also used by pr.yaml (deploy-report comment) and ci.yaml (reaction + results comment).

Proposed fix: replace the PAT with a GitHub App installation token (minted per-job via actions/create-github-app-token@v2) — more secure than a PAT (scoped, short-lived, not tied to a personal account). Requires a maintainer to create/install a small App and add APP_ID + APP_PRIVATE_KEY secrets. App permissions needed (repo-level): Contents: read, Actions: write, Issues: write, Pull requests: write.

2. Push-to-master fails: "No pull requests found" (fatal)

In .github/workflows/pr.yaml, the lint job uses sharesight/find-github-pull-request@v1.3.0 with failIfNotFound: true (lines 129–134). A direct push to master has no associated PR, so the step fails and aborts linting. The deploy-report job has the symmetric issue via 8BitJonny/gh-get-current-pr@4.0.0 (empty PR number → comment step fails). This is the failure on the run that prompted this report (run #30533217354).

Proposed fix: set failIfNotFound: false and gate the downstream label/skip logic on steps.find-pr.outputs.pr_found == 'true' (linter still runs with full checks on direct pushes); guard the deploy-report comment step on pr_found == 'true'.

3. Node.js 20 deprecation warnings

sharesight/find-github-pull-request@v1.3.0 and 8BitJonny/gh-get-current-pr@4.0.0 still target Node 20 (force-upgraded to 24, emitting warnings). Neither has a newer Node-24-native release, so there's no clean tag bump. Making the steps optional (item 2) reduces their blast radius; the warnings themselves are non-fatal.

Out of scope (not CI bugs)

• Bot-generated wrappers failing lint/test (mirge3 ×11 on PR mirge3: auto-generated tool wrapper (issue #1932) #1933, ketos arrow/page.xml datatypes, etc.) — the bot is correctly being caught by CI; root cause is the bot/LLM.
• glm model timeouts + malformed XML (.gxy-tool-bot.yml, switched in 083065f) — external LLM-service issue driving the wrapper failures above. Separate maintainer decision.

Ask

Do we want a PR addressing items 1–3? Item 1 needs a maintainer to set up the GitHub App + secrets regardless; items 2–3 are pure code changes I can put up immediately. Happy to do all three in one PR or split them.

[bgruening]

The CI is shared with IUC and many other repos. 1) should be configured that its not failing when there are not credentials, because all the tool repos will most likely not use it. 2) seems fine, but needs to be fixed upstream. 3) also upstream I think.