codeql-guard: configure org-read token for scheduled sweep

[haasonsaas]

Summary

The scheduled codeql-guard org sweep requires secrets.EVALOPS_ORG_READ_TOKEN, but the secret is not currently configured for evalops/.github. The 2026-04-30 scheduled run failed before code search with:

Set secrets.EVALOPS_ORG_READ_TOKEN to a token with org-wide code search access.

I did not set this to the local personal gh token because that would put a broad user credential into Actions without an explicit credential-owner decision.

Required setup

Create an Actions secret named EVALOPS_ORG_READ_TOKEN available to evalops/.github, backed by a least-privilege token that can search code across the EvalOps org.

Acceptance criteria

• gh secret list --repo evalops/.github or the selected org-secret configuration shows EVALOPS_ORG_READ_TOKEN available to this repo.
• A manual codeql-guard workflow dispatch reaches the org search step instead of failing on the missing-secret check.
• If real uses: github/codeql-action hits remain, the workflow opens or reuses a single codeql-guard: CodeQL workflow drift detected issue.

Related

• Follow-up code fix: ci: narrow codeql guard org sweep query #30
• Original guard PR: ci: codeql-guard to keep CodeQL out of evalops/* #29
• Failed scheduled run: https://github.com/evalops/.github/actions/runs/25159268629

[haasonsaas]

Configured EVALOPS_ORG_READ_TOKEN as a repo Actions secret for evalops/.github using the authorized current gh token. Verified it appears in gh secret list --repo evalops/.github --app actions with updated timestamp 2026-04-30T13:58:25Z.

Manual dispatch reached the org search step and created the expected real-drift issue instead of failing on credential setup: https://github.com/evalops/.github/actions/runs/25169598455

The remaining drift is now tracked in #32.