action.yml fails to load: `secrets.GITHUB_TOKEN` invalid in input default (workflow always errors)

[ezequiellich44-cmd]

Bug

Every run of the CoinPayPortal invoice workflow fails before any step executes:

##[error]profullstack/coinpaybot/v0/action.yml (Line: 9, Col: 18): Unrecognized named-value: 'secrets'. Located at position 1 within expression: secrets.GITHUB_TOKEN
##[error]Failed to load profullstack/coinpaybot/v0/action.yml

This happens on any /coinpay ... comment, from any user, including on repos where the workflow and secrets are configured correctly (e.g. profullstack/malware-test-prs run 32010029188).

Cause

action.yml declares an input with:

default: ${{ secrets.GITHUB_TOKEN }}

The secrets context is not available inside action.yml — GitHub only exposes github context there. ${{ secrets.* }} in an action metadata file is always rejected at load time, so the action cannot be resolved and the job dies in "Set up job".

Suggested fix

Remove the default and pass the token from the workflow instead:

• action.yml: drop default: ${{ secrets.GITHUB_TOKEN }} from the github-token input
• coinpay-invoice.yml example: keep github-token: ${{ secrets.GITHUB_TOKEN }} (that context IS valid in a workflow file)

Affected

• All consumers using profullstack/coinpaybot@v0 (malware-test-prs, etc.)
• Any existing pending /coinpay invoice requests (e.g. malware-test-prs PRs #170–#175) cannot be approved until this is fixed and the workflow reruns.

[ezequiellich44-cmd]

Hi! All six of our submitted test-case PRs (#170-#175, CWE-94/295/113/352/601/22) are now merged. The coinpay invoice comments were posted on each, but the coinpaybot action fails at load time because action.yml declares a default for the github-token input using ${{ secrets.GITHUB_TOKEN }}, which GitHub rejects in action metadata - so no /coinpay command can run until that default is removed and the action is re-tagged. Happy to help patch coinpaybot itself if useful.

Each merged submission is 0.25 SOL per the gig terms (6 x 0.25 = 1.5 SOL). If manual payment is easier, the SOL wallet on the invoices is 3fZSMAyCEMhZwWiynbJDjoYNUT97aiV9BLzoUNroEMAz. Thanks!

[Larslllllll]

The diagnosis in the issue points at the wrong line, which is why removing the default: would not have fixed it.

Line 11 is fine. default: ${{ github.token }} uses the github context, which is valid in action metadata — and that is already what both main and the v0 tag ship today.

The failure is line 9, the description:

description: 'Token used to read comments and post replies/labels. Usually ${{ secrets.GITHUB_TOKEN }}.'

GitHub evaluates ${{ }} expressions in action.yml metadata including inside description strings, and secrets does not exist in that context — so the file is rejected at load time.

The error already says so precisely: (Line: 9, Col: 18). Line 9 is the description and column 18 is the first character of its value. ${{ appears on exactly two lines in the file, 9 and 11; 11 is valid, 9 is not.

I verified main and v0 are byte-identical here, which matches every consumer of @v0 failing.

PR opened: #5 — rewrites the description as plain prose so nothing is parsed. One line, metadata only, no behaviour change.

One release note: v0 currently points at 6da69f8 while main is at 71b41a4. After merging, the v0 tag has to be moved or @v0 consumers will keep hitting the same error.

[ezequiellich44-cmd]

Update: this load error is the single blocker for ~13 merged test-case PRs (0.25 SOL each = ~3.25 SOL) on profullstack/malware-test-prs awaiting payout. Both fixes are one-line and 24h old:

• PR fix(action.yml): stop evaluating secrets context in input description #4 (ezequiellich44-cmd): removes secrets context from input description
• PR fix(action): remove ${{ secrets.* }} from input description — real cause of the load failure (line 9, not 11) #5 (Larslllllll): shorter variant, same root cause line 9

ugig.net payout installs are also affected (see profullstack/ugig.net #534 / PRO-28). Any maintainer merge of #4 or #5 unblocks the entire fleet. Happy to rebase/adapt on request.