chore: remove unused handover-translations workflow - #1615
Merged
Jingjing Jia (jingjingjia-ms) merged 2 commits intoSep 2, 2026
Merged
Conversation
The translation handover process has been inactive since November 2022. The workflow passed a long-lived write-scoped PAT to a third-party action pinned to a mutable tag, so removing it eliminates that exposure. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Jingjing Jia (jingjingjia-ms)
requested a review
from a team
as a code owner
September 2, 2026 22:34
Copilot started reviewing on behalf of
Jingjing Jia (jingjingjia-ms)
September 2, 2026 22:34
View session
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Repository documentation/instructions still reference handover-translations.yml as active and should be updated/removed to avoid stale guidance after the workflow deletion.
Pull request overview
This PR removes the deprecated GitHub Actions workflow that previously handed off localized messages/GE_* files to microsoftgraph/microsoft-graph-explorer-v4, eliminating an inactive automation path and its associated secret-handling risk.
Changes:
- Delete
.github/workflows/handover-translations.yml(translation handoff workflow) entirely. - Remove the workflow’s ability to run on pushes to
devand consumeAPI_TOKEN_GITHUB/ related secrets.
File summaries
| File | Description |
|---|---|
| .github/workflows/handover-translations.yml | Removes an unused translation handoff workflow to eliminate a security exposure path. |
Review details
Suppressed comments (1)
.github/workflows/handover-translations.yml:1
- Deleting this workflow leaves several repo docs/instructions referring to
.github/workflows/handover-translations.ymlas an active translation handoff (e.g.,repo-context.md,AGENTS.md, and.github/instructions/ci-workflows.instructions.md). Those references will become stale/misleading once this merges, so they should be updated or removed as part of the same change set (or in a clearly linked follow-up PR).
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Gavin Barron (gavinbarron)
approved these changes
Sep 2, 2026
Peter Ombwa (peombwa)
approved these changes
Sep 2, 2026
Jingjing Jia (jingjingjia-ms)
deleted the
chore/remove-handover-translations-workflow
branch
September 2, 2026 23:35
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removes
.github/workflows/handover-translations.yml, which is no longer used.Why
The process is inactive. The workflow copied
messages/GE_*intomicrosoftgraph/microsoft-graph-explorer-v4as a PR. The last one it produced was explorer-v4#2244 on 2022-11-17 — nothing since. No runs remain in Actions history, andmessages/has been untouched since May 2023.It carries a security exposure. The workflow passed
secrets.API_TOKEN_GITHUB— a write-scoped PAT, last rotated 2021-08-24 — intopaygoc6/action-pull-request-another-repo@v1.0.1, a third-party action on a personal account pinned to a mutable tag. Whoever controls that tag controls code that receives the token, since auses:step runs arbitrary code with the secret in its environment. It also usesactions/checkout@v2.3.4. This was flagged by security scanning as a true positive.Deleting the workflow removes the exposure entirely, rather than pinning a SHA on a workflow nobody needs.
Follow-up (not in this PR)
Once this merges, the repo secrets
API_TOKEN_GITHUB,ACTION_EMAIL, andACTION_USERNAMEare unused and should be deleted.API_TOKEN_GITHUBshould also be revoked at its source, not just removed here — deleting the repo secret removes GitHub's copy but does not invalidate the token. It appears to be a classic PAT belonging to an individual account, which means broadreposcope rather than access limited to explorer-v4.