From f10d9bc8a7813d0c2c7aaca58812daf563f42eaf Mon Sep 17 00:00:00 2001
From: Chris Mungall <cjm@berkeleybop.org>
Date: Thu, 16 Jul 2026 07:43:44 -0700
Subject: [PATCH] Avoid persisting Dragon checkout credentials

---
 .github/workflows/ai-agent.yml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ai-agent.yml b/.github/workflows/ai-agent.yml
index 562a56301..a8de08e41 100644
--- a/.github/workflows/ai-agent.yml
+++ b/.github/workflows/ai-agent.yml
@@ -60,6 +60,7 @@ jobs:
         with:
           fetch-depth: 1
           token: ${{ secrets.PAT_FOR_PR }}
+          persist-credentials: false
 
       - name: Check for qualifying mention
         id: check
@@ -250,6 +251,7 @@ jobs:
         with:
           fetch-depth: 1
           token: ${{ secrets.PAT_FOR_PR }}
+          persist-credentials: false
 
       - name: Configure Git
         run: |
@@ -277,11 +279,15 @@ jobs:
           uv pip install aurelian jinja2-cli "wrapt>=1.17.2"
           echo "${{ github.workspace }}/.venv/bin" >> "$GITHUB_PATH"
 
-      - name: Export GitHub token for gh CLI
-        run: echo "GH_TOKEN=${{ secrets.PAT_FOR_PR }}" >> "$GITHUB_ENV"
+      - name: Configure GitHub authentication
+        env:
+          GH_TOKEN: ${{ secrets.PAT_FOR_PR }}
+        run: gh auth setup-git --hostname github.com --force
 
       - name: Run Claude Code
         uses: anthropics/claude-code-action@v1
+        env:
+          GH_TOKEN: ${{ secrets.PAT_FOR_PR }}
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           github_token: ${{ secrets.PAT_FOR_PR }}