cc @elastic/observablt-ci

Recent workflow changes introduced documentation drift in the GH-AW triage/dependency workflow docs. The docs still describe an old token/job model and do not describe the new follow-up relabel jobs required to emit installation-token labeled events.

Changes Requiring Documentation Updates

1. Obsolete mint-gh-aw-github-token / GH_AW_GITHUB_TOKEN model in workflow docs

Commit(s): 78d57e1

What changed (code):

• .github/workflows/gh-aw-dependency-review.yml now runs dependency-review directly and adds signal-dependency-review-followups; no mint-gh-aw-github-token job remains (.github/workflows/gh-aw-dependency-review.yml:18-108).
• .github/workflows/gh-aw-resource-not-accessible-by-integration-triage.yml now runs triage directly and adds signal-res-not-accessible-triage-followups; no mint-gh-aw-github-token job remains (.github/workflows/gh-aw-resource-not-accessible-by-integration-triage.yml:20-267).
• .github/workflows/gh-aw-security-triage.yml now runs triage directly and adds signal-security-triage-followups; no mint-gh-aw-github-token job remains (.github/workflows/gh-aw-security-triage.yml:19-166).

Documentation currently out of date:

• docs/workflows/gh-aw-dependency-review.md:41-42 still documents a mint-gh-aw-github-token job.
• docs/workflows/gh-aw-resource-not-accessible-by-integration-triage.md:13,17,21,35 still documents mint job + GH_AW_GITHUB_TOKEN model.
• docs/workflows/gh-aw-security-triage.md:13,17,21,35 still documents mint job + GH_AW_GITHUB_TOKEN model.

Documentation impact:
These docs describe the wrong auth/job topology, making runbook/debug behavior inaccurate for contributors.

2. Missing documentation of new follow-up relabel signaling behavior

Commit(s): 78d57e1

What changed (code):

• Added follow-up jobs that mint ephemeral tokens and remove/re-add readiness labels so downstream workflows receive installation-token labeled events:
  • signal-dependency-review-followups (.github/workflows/gh-aw-dependency-review.yml:59-108)
  • signal-res-not-accessible-triage-followups (.github/workflows/gh-aw-resource-not-accessible-by-integration-triage.yml:221-267)
  • signal-security-triage-followups (.github/workflows/gh-aw-security-triage.yml:110-166)

Documentation currently missing this behavior:

• docs/workflows/gh-aw-dependency-review.md
• docs/workflows/gh-aw-resource-not-accessible-by-integration-triage.md
• docs/workflows/gh-aw-security-triage.md

Documentation impact:
Label-driven downstream routing behavior is not accurately documented, so operators cannot reliably understand why follow-up workflows are (or are not) triggered.

Suggested Actions

• In docs/workflows/gh-aw-dependency-review.md, remove references to mint-gh-aw-github-token/cross-job token output and document the actual dependency-review + signal-dependency-review-followups flow.
• In docs/workflows/gh-aw-resource-not-accessible-by-integration-triage.md, replace mint-job/GH_AW_GITHUB_TOKEN text with the current triage job contract and document signal-res-not-accessible-triage-followups relabel behavior.
• In docs/workflows/gh-aw-security-triage.md, replace mint-job/GH_AW_GITHUB_TOKEN text with the current triage job contract and document signal-security-triage-followups relabel behavior.
• For all three docs above, update permissions sections to reflect that OIDC token minting now occurs in the follow-up signaling job (with id-token: write) rather than a dedicated pre-triage/pre-review mint job.

What is this? | From workflow: Observability Agentic Workflow Entrypoint

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

• expires on May 12, 2026, 7:06 AM UTC