[plan] Fix artipacked credential persistence in copilot-token-audit and copilot-token-optimizer (Medium)

[github-actions]

Objective

Fix the Medium-severity artipacked findings in copilot-token-audit and copilot-token-optimizer workflows. These workflows check out code and create artifacts while secrets are accessible, risking credential persistence via artifacts.

Context

The artipacked finding from zizmor means a workflow both checks out code AND uploads artifacts in a context where GitHub tokens or other secrets are present. This risks accidentally persisting credentials into artifacts that could be downloaded.

Reference: Static Analysis Report - 2026-04-11

• copilot-token-audit.lock.yml line 368
• copilot-token-optimizer.lock.yml line 351

Approach

1. Open .github/workflows/copilot-token-audit.md and .github/workflows/copilot-token-optimizer.md
2. For each workflow, identify:
   • The actions/checkout step (or equivalent)
   • The artifact upload step
   • Any secrets/tokens used in the same job
3. Apply one of these fixes:
   • Option A: Separate the checkout/secret-using work from artifact uploading into different jobs with minimal permissions
   • Option B: Exclude sensitive paths from artifact uploads (e.g., .git/ directory, credential files)
   • Option C: If the checkout is not needed in the same job as secrets, move it to a separate job
4. Run make recompile to regenerate lock files
5. Run make agent-finish to validate

Steps

1. Examine copilot-token-audit.md around the step at lock line 368
2. Examine copilot-token-optimizer.md around the step at lock line 351
3. Determine the appropriate fix for each based on the workflow's structure
4. Apply the fix in the .md source files
5. Recompile and validate

Acceptance Criteria

• artipacked findings resolved in both workflows
• No credential files or .git directories included in artifacts
• Workflow functionality is preserved
• make recompile completes without errors
• make agent-finish passes
  Related to [static-analysis] Static Analysis Report - 2026-04-11 #25835

Generated by Plan Command for issue #25835 · ● 199.3K · ◷

• expires on Apr 13, 2026, 11:54 PM UTC