[aw-failures] [aw] PR Sous Chef: add_comment failing with 401 Bad credentials (AWI_MAINTENANCE_TOKEN)

[github-actions]

Problem

Rotate AWI_MAINTENANCE_TOKEN now — every add_comment safe-output call in the PR Sous Chef workflow is failing with GitHub REST 401 Bad credentials, deterministically, 4/4 calls in each of the last 2 runs.

Affected Workflows and Runs

• .github/workflows/pr-sous-chef.lock.yml — safe_outputs job, "Process Safe Outputs" step
• §30446544004 (2026-07-29T11:19:14Z) — 4/4 add_comment calls failed
• §30443115827 (2026-07-29T10:24:58Z) — same signature, same failure count

Probable Root Cause

The add_comment safe-output handler is pinned to a dedicated secret instead of the default workflow token:

"add_comment":{"github-token":"${{ secrets.AWI_MAINTENANCE_TOKEN }}","max":4,"target":"*"}

Every other handler in the same lock file (update_pull_request, create_issue, etc.) uses GH_AW_GITHUB_TOKEN/GITHUB_TOKEN and succeeds. AWI_MAINTENANCE_TOKEN is very likely expired, revoked, or missing required scope — the agent job (which doesn't touch this secret) succeeds in both runs, isolating the fault to this one credential.

audit-diff between the two failed runs confirms identical safe_outputs call counts (13/13) despite wildly different upstream agent session sizes (near-zero vs full session) — the 401 is independent of what the agent produced, consistent with a broken static credential rather than a transient or workload-dependent issue.

Proposed Remediation

1. Check AWI_MAINTENANCE_TOKEN expiry/revocation status in whatever system issues it (PAT settings or GitHub App installation).
2. Regenerate/rotate the token; ensure scope includes issue/PR comment write (repo classic scope, or issues:write + pull_requests:write fine-grained).
3. If fine-grained, re-authorize for SSO on github/gh-aw if the org enforces SAML SSO.
4. Update the secret value in repo/org settings (do not touch the lock file — the reference is correct, only the secret value is bad).

Success Criteria

• Next scheduled pr-sous-chef run completes with safe_outputs job conclusion = success.
• Zero "Bad credentials" errors in that run's audit output.
• add_comment items appear with an accepted/success outcome instead of erroring.
  Related to [aw-failures] [aw] Failure Investigator Report — 2026-07-29 (6h) #48897

Generated by 🔍 [aw] Failure Investigator (6h) · age00 · 150.8 AIC · ⌖ 26 AIC · ⊞ 5.1K · ◷

• expires on Aug 5, 2026, 5:35 AM UTC-08:00

---

Update — 2026-07-29 19:12 UTC (6h window)

Still broken — do not close. AWI_MAINTENANCE_TOKEN continues returning 401 Bad credentials on add_comment calls. Two more deterministic failures since the last report:

• §30460907331 (14:26 UTC) — add_comment 401 x4+
• §30456200459 (13:28 UTC) — add_comment 401 x2

New correlated symptom found this window — same PR, every run, regardless of the add_comment outcome: update_pull_request (update branch from base) fails with GitHub REST 403 on PR #48593, 3/3 PR Sous Chef runs this window:

• §30465347575 (15:20 UTC)
• §30460907331 (14:26 UTC)
• §30456200459 (13:28 UTC)

PUT /repos/github/gh-aw/pulls/48593/update-branch - 403
Unable to determine if workflow can be created or updated due to timeout; `workflows` scope may be required.

This is very likely the same broken/under-scoped credential hitting a different API surface: update-branch requires the workflows OAuth scope when the target PR's history touches .github/workflows/**, and PR #48593 does. Fix the token rotation checklist to explicitly verify the workflows scope, not just repo/issue write — otherwise this symptom will resurface immediately after rotation.

Parent: #48897

Generated by 🔍 [aw] Failure Investigator (6h) · age00 · 180.4 AIC · ⌖ 24.4 AIC · ⊞ 5.5K · ◷

---

Update — 2026-07-30 01:14 UTC (6h window)

Fixed — closing. The most recent PR Sous Chef run in this window (§30483968883, 19:20 UTC) shows the safe_outputs job completed successfully end-to-end:

• add_comment → 2/2 calls succeeded (e.g. https://github.com/github/gh-aw/pull/48960#issuecomment-5122578850, .../pull/48955#issuecomment-5122579026) — zero 401 errors.
• update_pull_request (the update-branch 403 symptom from the last update) → 2/2 calls succeeded against PR Align safe-output no-context behavior: allow MCP enqueue, rely on runtime soft-skip #48955 and test(semver): upgrade semver_precise_test.go to testify + expand coverage #48960 — zero 403 errors.

AWI_MAINTENANCE_TOKEN is evidently rotated/repaired. This run did have a different, unrelated failure in the conclusion job (DNS resolution cascade, tracked separately in a new sub-issue on parent #48897), but the credential problem this issue tracks is resolved.

Verification: re-open if add_comment or update_pull_request 401/403s reappear in pr-sous-chef.lock.yml.

Parent: #48897

Generated by 🔍 [aw] Failure Investigator (6h) · age00 · 161.9 AIC · ⌖ 20.7 AIC · ⊞ 5.2K · ◷

[github-actions]

🍪 Issue Monster selected this for Copilot

I identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 1.56 AIC · ⌖ 6.43 AIC · ⊞ 7.2K · ◷