refactor(security): move GIST_PAT from CLI args to environment variables

.github/workflows/reusable-process-response.yml

@@ -135,7 +135,6 @@ jobs:
           python scripts/contributor_manager.py \
             --action check_exists \
             --username "$PR_AUTHOR" \
-            --gist-pat "$GIST_PAT" \
             --output-file ../check_result.json
 
           if [ -f ../check_result.json ]; then
@@ -176,8 +175,7 @@ jobs:
             --repo-name "$REPO_NAME" \
             --pr-title "$PR_TITLE" \
             --lines-changed "$LINES_CHANGED" \
-            --labels "$LABELS" \
-            --gist-pat "$GIST_PAT"
+            --labels "$LABELS"
 
       # Post success message
       - name: Post success message

.github/workflows/reusable-request-info.yml

@@ -55,7 +55,6 @@ jobs:
           python scripts/contributor_manager.py \
             --action check_exists \
             --username "$PR_AUTHOR" \
-            --gist-pat "$GIST_PAT" \
             --output-file ../check_result.json
 
           if [ -f ../check_result.json ]; then

.github/workflows/reusable-update-pr.yml

@@ -57,7 +57,6 @@ jobs:
           python scripts/contributor_manager.py \
             --action check_exists \
             --username "${{ inputs.pr_author }}" \
-            --gist-pat "$GIST_PAT" \
             --output-file ../check_result.json
 
           if [ -f ../check_result.json ]; then
@@ -106,8 +105,7 @@ jobs:
             --repo-name "$REPO_NAME" \
             --pr-title "$PR_TITLE" \
             --lines-changed "$LINES_CHANGED" \
-            --labels '${{ steps.labels.outputs.result }}' \
-            --gist-pat "$GIST_PAT"
+            --labels '${{ steps.labels.outputs.result }}'
 
       - name: Not onboarded
         if: steps.check.outputs.exists == 'false'

scripts/contributor_manager.py

@@ -19,11 +19,14 @@
 class ContributorManager:
     """Manages contributor TOML files in GitHub Gist."""
 
-    def __init__(self, gist_pat: str):
-        if not gist_pat or gist_pat.strip() == '':
-            raise ValueError("GIST_PAT is required")
-
-        self.gist_pat = gist_pat
+    def __init__(self, gist_pat: str = None):
+        if gist_pat:
+            self.gist_pat = gist_pat
+        else:
+            self.gist_pat = os.environ.get('GIST_PAT')
+
+        if not self.gist_pat or self.gist_pat.strip() == '':
+            raise ValueError("GIST_PAT is required (set as env var or pass explicitly)")
         self.config = load_config()
         self.gist_url = self.config['gist']['registry_url']
         self.repo_dir = None
@@ -180,7 +183,7 @@ def main():
     parser.add_argument('--pr-title', help='PR title')
     parser.add_argument('--lines-changed', type=int, default=0, help='Lines changed')
     parser.add_argument('--labels', help='PR labels (JSON array string)')
-    parser.add_argument('--gist-pat', required=True, help='GitHub PAT for Gist')
+    # parser.add_argument('--gist-pat', required=True, help='GitHub PAT for Gist')
     parser.add_argument('--output-file', help='Output file for results')
 
     args = parser.parse_args()
@@ -213,7 +216,13 @@ def main():
             parser.error(f"add_pr action requires: --{', --'.join(missing)}")
 
     try:
-        manager = ContributorManager(args.gist_pat)
+        # Get GIST_PAT from env if not passed (though we removed the arg, so it must be from env)
+        gist_pat = os.environ.get('GIST_PAT')
+        if not gist_pat:
+            print("Error: GIST_PAT environment variable is required")
+            sys.exit(1)
+
+        manager = ContributorManager(gist_pat)
 
         if args.action == 'check_exists':
             exists = manager.contributor_exists(args.username)