fix(build-worker): use GitHub PAT from Parameter Store instead of env var

[llama90]

Summary

Fixes SSM parameter access issue where build worker couldn't retrieve GitHub PAT for repository_dispatch API.

Problem

Build worker was using a temporary GITHUB_TOKEN environment variable workaround because SSM parameter access wasn't implemented.

Solution

Added getGitHubToken() function

• Retrieves GitHub PAT from /laco/cmn/github/pat/cloud-apps (common environment)
• Uses direct parameter path instead of getSecret() to avoid environment-specific prefix
• Supports local development with GITHUB_PAT_CLOUD_APPS env var

Code Changes

• secrets.ts: New getGitHubToken() function with SSM integration
• build/index.ts: Remove TODO comments and use getGitHubToken() instead of env var

IAM Permissions

Requires Lambda IAM role to have SSM parameter access (configured in cloud-sandbox PR):

{
  effect = "Allow"
  actions = ["ssm:GetParameter"]
  resources = ["arn:aws:ssm:ca-central-1:*:parameter/laco/cmn/github/pat/cloud-apps"]
}

GitHub PAT Permissions

The PAT must have these permissions (see cloud-control-plane PR for guide):

• ✅ Contents: Read and write
• ✅ Actions: Read and write
• ✅ Workflows: Read and write
• ✅ Metadata: Read-only

Testing

✅ Tested via Slack /build command - successfully triggers GitHub Actions workflow

Related PRs

• cloud-sandbox: Build worker infrastructure
• cloud-control-plane: GitHub OIDC and secrets

---

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR replaces the temporary GITHUB_TOKEN environment variable workaround with proper AWS Systems Manager (SSM) Parameter Store integration for retrieving the GitHub PAT used to trigger repository_dispatch API calls.

Key Changes:

• Added getGitHubToken() function to retrieve GitHub PAT from SSM Parameter Store path /laco/cmn/github/pat/cloud-apps
• Removed TODO comments and temporary environment variable workaround in build worker
• Supports local development via GITHUB_PAT_CLOUD_APPS environment variable

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
applications/chatops/slack-bot/src/shared/secrets.ts	Adds new getGitHubToken() function to retrieve GitHub PAT from common SSM parameter path with local development fallback
applications/chatops/slack-bot/src/workers/build/index.ts	Replaces temporary GITHUB_TOKEN environment variable with proper getGitHubToken() call and removes TODO comments

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

@llama90 I've opened a new pull request, #13, to work on those changes. Once the pull request is ready, I'll request review from you.