Merge pull request #412 from githubnext/codex/evergreen-avoid-pr-activation

Avoid PR-event Evergreen activation

Author: mrjf

.github/workflows/evergreen.lock.yml

@@ -1,7 +1,5 @@
 ---
 on:
-  pull_request:
-    types: [labeled, synchronize, reopened, ready_for_review]
   push:
     branches: [main]
   schedule:
@@ -54,7 +52,8 @@ jobs:
         name: Evaluate PR gate state
         shell: bash
         env:
-          GH_TOKEN: ${{ secrets.GH_AW_CI_TRIGGER_TOKEN || github.token }}
+          GH_TOKEN: ${{ github.token }}
+          CI_TRIGGER_TOKEN: ${{ secrets.GH_AW_CI_TRIGGER_TOKEN || '' }}
           REPO: ${{ github.repository }}
           EVENT_NAME: ${{ github.event_name }}
           EVENT_ACTION: ${{ github.event.action }}
@@ -237,6 +236,14 @@ jobs:
             local head_sha="$2"
             local run_json run_id status conclusion
 
+            ci_gh() {
+              if [ -n "${CI_TRIGGER_TOKEN:-}" ]; then
+                GH_TOKEN="$CI_TRIGGER_TOKEN" "$@"
+              else
+                "$@"
+              fi
+            }
+
             run_json="$(gh run list --repo "$REPO" \
               --workflow "CI" \
               --commit "$head_sha" \
@@ -267,8 +274,8 @@ jobs:
             esac
 
             echo "Reactivating CI run $run_id for PR #$pr ($head_sha) (status=$status conclusion=$conclusion)."
-            gh run rerun "$run_id" --repo "$REPO" --failed || \
-              gh run rerun "$run_id" --repo "$REPO" || \
+            ci_gh gh run rerun "$run_id" --repo "$REPO" --failed || \
+              ci_gh gh run rerun "$run_id" --repo "$REPO" || \
               echo "Could not reactivate CI run $run_id; scheduled monitor will retry."
           }
 

.github/workflows/evergreen.md

@@ -73,12 +73,12 @@ readiness controller and the agentic orchestrator must both respect this file.
 
 ## Event Fast Paths
 
-- `pull_request` activity types: `labeled`, `synchronize`, `reopened`,
-  `ready_for_review`.
+- `pull_request` activity types: not wired in the gh-aw Evergreen workflow.
+  PR activity is covered by schedule/manual/default-branch reconciliation to
+  avoid gh-aw confused-deputy activation on bot-authored PRs.
 - Default-branch `push` policy: `push` to `main` wakes the reconciliation loop
   because it can make labeled PRs stale or conflicted.
-- `workflow_run` policy: not wired in v1; the schedule + `synchronize` cover CI
-  state changes.
+- `workflow_run` policy: not wired in v1; the schedule covers CI state changes.
 - Review event policy: not wired (reviews are not merge gates here).
 - Deployment event policy: not wired (no deployment gates).
 - Slash-command policy: not wired in v1.
@@ -98,8 +98,8 @@ readiness controller and the agentic orchestrator must both respect this file.
   through safe outputs by the agent (never from preflight) and labeled
   `evergreen: trigger CI`; they do not count as semantic repair attempts.
 - Token policy: `GITHUB_TOKEN` for reads and control-plane label writes.
-  `GH_AW_CI_TRIGGER_TOKEN` (existing PAT) is used by gh-aw for CI reruns and
-  pushes so that PR branch pushes trigger CI (default-token pushes do not).
+  `GH_AW_CI_TRIGGER_TOKEN` (existing PAT) is used only for CI reruns and
+  safe-output pushes so default-token limitations do not block CI.
 
 ## Repair Policy