fix(openshift-developer): refresh GitHub tokens before push/reply

[bryan-cox]

Summary

• Add a pre-step to address-review-pr skill that refreshes GitHub App tokens before posting replies or pushing
• Calls /tmp/refresh-github-tokens.sh if it exists (written by the CI process step in openshift/release)
• No-op outside CI — the script only exists when the review-agent process step creates it

Problem

GitHub App installation tokens expire after 1 hour. The PR #9102 review-agent session ran for 1h17m — the agent processed everettraven's review comment correctly but couldn't post a reply or push because the token had expired.

Companion PR

• fix: refresh GitHub App tokens before push/reply in review-agent openshift/release#82494 — writes the refresh script and switches to file-based token storage

Test plan

• Verify skill still works locally (no /tmp/refresh-github-tokens.sh → skipped gracefully)
• Verify in CI with companion PR: tokens refresh before push/reply

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Improved reliability when posting review replies or pushing changes by refreshing GitHub authentication tokens beforehand when needed.
  • Operations now continue gracefully if token refresh is unavailable or unsuccessful.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bryan-cox

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• plugins/openshift-developer/OWNERS [bryan-cox]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 2e288ea3-6c84-4511-a458-73a4a21978bc

📥 Commits

Reviewing files that changed from the base of the PR and between bc1f773 and 190d29c.

📒 Files selected for processing (1)

• plugins/openshift-developer/skills/address-review-pr/SKILL.md

🚧 Files skipped from review as they are similar to previous changes (1)

• plugins/openshift-developer/skills/address-review-pr/SKILL.md

---

Walkthrough

The review skill adds a pre-step that conditionally runs /tmp/refresh-github-tokens.sh before posting replies or pushing changes, while continuing execution if token refresh fails.

Changes

GitHub token refresh

Layer / File(s)	Summary
Refresh token pre-step plugins/openshift-developer/skills/address-review-pr/SKILL.md	Documents refreshing GitHub App tokens when the executable refresh script is available and continuing when refresh fails.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: dgoodwin, enxebre

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (2 errors)

Check name	Status	Explanation	Resolution
No Assumed Git Remote Names	❌ Error	SKILL.md still hardcodes git ls-remote origin <branch> without discovering the remote name first.	Replace the origin check with the discovered remote variable (or derive the tracked remote via git branch -vv/git remote) before verification.
Git Push Safety Rules	❌ Error	The skill still has an unconditional git push step with no user confirmation, branch restriction, or force-push guard; the new token-refresh step doesn't change that.	Gate step 4b behind explicit user approval and block main/master and force-push variants before any push.

✅ Passed checks (8 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: refreshing GitHub tokens before replying or pushing.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No Real People Names In Style References	✅ Passed	No real-person names are used as style references or examples in the changed skill doc.
No Untrusted Mcp Servers	✅ Passed	Only SKILL.md changed, and the diff adds a shell token-refresh step with no MCP server installs or references.
Ai-Helpers Overlap Detection	✅ Passed	No overlapping open PRs found; the closest existing skill, address-review-precommit, is only a partial match (~39% similarity), below the 60% flag threshold.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[enxebre]

If we need to do this I'd rather just use a gh PAT. If still want to use the app, I'd rather let a script in the CI runner to refresh it in loop so claude can just pick whatever is in disk