Durably document required secrets

[edburns]

Fixes #2045

@MackinnonBuck wrote:

I just attempted to publish an SDK prerelease and the Java step failed. It seems the token used for publishing the Java SDK might have expired? Publish SDK packages · github/copilot-sdk@1f5516e

Will install a new one and ping you back.

I will also ensure the documentation for this dependency is updated.

[Copilot]

Pull request overview

Adds a maintainer-facing inventory of GitHub Actions secrets, their purposes, and affected workflows.

Changes:

• Documents SDK testing and agentic workflow secrets.
• Documents Java and Rust publishing credentials.
• Links to secret-management resources.

Show a summary per file

File	Description
docs/developer-docs/secrets.md	Adds the repository secrets-management guide.

Review details

Comments suppressed due to low confidence (4)

docs/developer-docs/secrets.md:26

• These two workflow lists are broader than the actual usage. Both secrets occur in the 11 generated .lock.yml workflows, but neither java-codegen-check.yml nor java-smoke-test.yml references them; those two only use COPILOT_GITHUB_TOKEN. Avoid documenting secrets as required for workflows that do not consume them.

* **`GH_AW_GITHUB_TOKEN`**: GitHub token used by the gh-aw runtime for workflow orchestration.
  * Workflows: same as `COPILOT_GITHUB_TOKEN` above

* **`GH_AW_GITHUB_MCP_SERVER_TOKEN`**: Token used by the GitHub MCP server container within agentic workflows.
  * Workflows: same as `COPILOT_GITHUB_TOKEN` above

docs/developer-docs/secrets.md:31

• Read access alone is insufficient for this token. cross-repo-issue-analysis.md also supplies it to the GitHub tool and safe outputs, which add labels to the triggering SDK issue and create a linked issue in github/copilot-agent-runtime. A replacement token provisioned from this description would fail those writes.

* **`RUNTIME_TRIAGE_TOKEN`**: Token with read access to `github/copilot-agent-runtime`. Used to clone that repository for cross-repo issue analysis.

docs/developer-docs/secrets.md:42

• The Java build uses the Central Publishing plugin and central.sonatype.com, not the legacy OSSRH service. Calling these OSSRH credentials can send maintainers to the wrong credential system when rotating the token that motivated this PR.

* **`JAVA_MAVEN_CENTRAL_USERNAME`**: Username for Maven Central (Sonatype OSSRH) authentication.
  * Workflows: `java-publish-maven.yml`, `java-publish-snapshot.yml`

* **`JAVA_MAVEN_CENTRAL_PASSWORD`**: Password or token for Maven Central (Sonatype OSSRH) authentication.
  * Workflows: `java-publish-maven.yml`, `java-publish-snapshot.yml`

docs/developer-docs/secrets.md:53

• This token also dispatches deploy-site.yml in github/copilot-sdk-java (java-publish-maven.yml:328-345), so Actions permission only on this repository is not enough. The workflow's preflight checks only the local changelog dispatch, meaning an incorrectly scoped replacement can pass preflight and then fail after publishing. Document both repositories and the classic-PAT equivalent.

* **`JAVA_RELEASE_GITHUB_TOKEN`**: GitHub token with **workflow dispatch** (actions:write) permission. Used to trigger the `release-changelog.lock.yml` workflow after a release is published.

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Medium