chore: use OPENHANDS_BOT_GITHUB_PAT_PRIVATE

[simonrosenberg]

Summary

Renames PAT secret references in workflow files to the scoped secret OPENHANDS_BOT_GITHUB_PAT_PRIVATE as part of OpenHands/evaluation#428 (PAT blast-radius reduction).

• Replaces secrets.PAT_TOKEN / secrets.ALLHANDS_BOT_GITHUB_PAT → secrets.OPENHANDS_BOT_GITHUB_PAT_PRIVATE
• No logic changes

Three scoped PAT identities:

Secret	Scope
OPENHANDS_BOT_GITHUB_PAT_PUBLIC	Public repos
OPENHANDS_BOT_GITHUB_PAT_PRIVATE	Private repos
OPENHANDS_BOT_GITHUB_PAT_EVAL_DISPATCH	Cross-repo workflow dispatch

[github-actions]

Coverage Report

File	Stmts	Miss	Cover	Missing
__init__.py	1	0	100%
app.py	91	39	57%	33, 36, 39, 45, 47, 50, 53–56, 59–60, 63, 70–71, 74–75, 79, 87–88, 91, 98–99, 101, 104–105, 108, 113–121, 123–125
auth.py	111	5	95%	71, 113, 270, 278–279
config.py	40	0	100%
constants.py	12	0	100%
db.py	44	26	40%	37–39, 48–49, 51–52, 54, 62, 69, 79, 82–83, 87–88, 96, 104, 109, 114, 117–123
dispatcher.py	137	35	74%	53, 73, 85, 87–88, 157, 161, 183, 190, 209–211, 239–241, 244–246, 281–282, 306–313, 334–335, 345–346, 353–354, 356
event_router.py	59	19	67%	83, 88, 119–121, 137–138, 156, 158, 160–161, 163, 173, 179–181, 184, 186, 188
exceptions.py	4	0	100%
execution.py	222	127	42%	45–47, 56, 89–92, 100–102, 110, 115–119, 133, 135, 137–140, 142–147, 149, 151–158, 160–161, 163, 178, 183, 194, 200–202, 213, 219–221, 268, 276, 280, 282–283, 288–289, 294, 342, 344, 362, 365–368, 390–393, 395, 403–404, 407, 413, 476–482, 485–486, 488, 490–492, 495, 498, 501–504, 506, 509–510, 513–515, 519, 522, 526–529, 531, 539–540, 544–546, 548–554, 558, 560, 569–571, 573–575
filter_eval.py	50	2	96%	161–162
logger.py	53	18	66%	25–26, 36, 46–47, 49–55, 68, 88, 90–93
models.py	80	0	100%
preset_router.py	159	50	68%	196–197, 202–209, 214, 217, 219–220, 231–234, 236–240, 245, 254, 391–392, 397–404, 409, 412, 414–415, 426–429, 431–435, 440, 450
router.py	113	64	43%	74–75, 95, 97, 100, 102, 116, 129, 131–132, 134–135, 138–140, 151–153, 171–174, 193, 196, 199, 206, 208, 237, 242–244, 247–249, 253–254, 259, 263–266, 268, 276, 278–279, 284–285, 288, 290, 292–294, 297–300, 305, 307–308, 317, 338–340, 344
scheduler.py	57	9	84%	124–125, 162–163, 178–179, 189–190, 192
schemas.py	268	18	93%	150, 156–158, 217–219, 221, 283, 312–313, 316, 321, 326, 332, 478, 486, 493
trigger_matcher.py	28	3	89%	72–74
uploads.py	107	59	44%	138–141, 149–151, 157–158, 161, 170–171, 174–175, 183–184, 186–189, 192–195, 197, 199–201, 203–206, 208–209, 211, 226, 232–233, 236, 239, 242, 245, 247, 260–261, 275, 278–280, 282–283, 285, 291–292, 305, 313–315, 319
watchdog.py	107	47	56%	63–64, 76–77, 82–84, 96–97, 241–242, 244, 246, 255, 257–259, 261, 268–270, 272–274, 276–277, 279, 294, 296, 301–304, 306–311, 313–319, 321
webhook_router.py	80	48	40%	57, 82–83, 107–108, 110, 113–114, 116, 126, 128–132, 137, 139, 151, 154, 157, 164–165, 167, 180, 182–183, 188, 204, 206–207, 213–215, 217–218, 220, 235, 237–238, 243–244, 261, 263–264, 270–271, 273, 275
event_schemas
__init__.py	29	1	96%	53
custom.py	33	5	84%	52–53, 64–66
detection.py	32	0	100%
github.py	125	4	96%	306, 311, 456, 483
presets
__init__.py	0	0	100%
storage
__init__.py	5	0	100%
factory.py	11	0	100%
file_store.py	18	5	72%	11, 20, 25, 30, 54
google_cloud.py	75	10	86%	103–108, 142–143, 196, 198
s3.py	115	14	87%	100, 102–103, 107, 109, 190, 213–215, 269–270, 275, 337–338
utils
__init__.py	4	0	100%
api_key.py	32	24	25%	40–41, 46–48, 50, 55, 60, 62–65, 67–68, 70–71, 73, 79, 81–82, 89, 91–92, 98
cron.py	45	6	86%	39, 45, 74, 80, 123, 140
run.py	75	12	84%	74–76, 172–174, 179–181, 228, 234–235
sandbox.py	108	82	24%	32–37, 51–52, 57–60, 62–64, 66–72, 84, 86, 96–97, 99–101, 103–104, 107–108, 114, 120–122, 132–133, 138–144, 167–168, 170–174, 176–180, 217–218, 220, 222–225, 230–231, 234, 236–237, 243–245, 250–252, 257–258, 266–268, 270
tarball_validation.py	48	0	100%
time.py	3	0	100%
webhook.py	51	16	68%	46, 51, 119, 129–131, 137, 174, 177–183, 189
TOTAL	2632	748	71%

[enyst]

@simonrosenberg Actually this changed, we should the OpenHands token here, that is, the one with public... Mmm, would it work?