mirror of
https://github.com/deepseek-ai/deepseek-harness.git
synced 2026-11-11 13:37:47 +08:00
Mint the check-run token from a dedicated approval App instead of a shared automation App, so the identity that owns the decision check suite is specific to this gate. The workflow reads `vars.DSH_APPROVAL_APP_CLIENT_ID` and `secrets.DSH_APPROVAL_APP_PRIVATE_KEY`, and the token stays scoped to `checks: write`.