From 05f7b618e53f6a816535d7b5eacf85fd73be59d0 Mon Sep 17 00:00:00 2001 From: razbroc Date: Thu, 27 Aug 2026 09:38:50 +0300 Subject: [PATCH] ci: give the workflow tokens a value that exists Both failing workflows failed for the same reason: `secrets.GH_PAT` is not configured on this repo, so the input resolved to an empty string and the action refused to start. PR Author Auto Assign Input required and not supplied: repo-token release-please release-please failed: Input required and not supplied: token Both now prefer `GH_PAT` and fall back to `github.token`, which is always populated. Each job already holds the permissions its action needs, so nothing depends on a secret being set. If the org sets `GH_PAT` later it takes precedence with no further change. This has to land on master to take effect. 908f19a and a88de87 both changed auto-author-assign.yml on a feature branch and neither ran: pull requests whose base branch already carried a working token still failed with the empty-input error, so `pull_request_target` is not resolving the workflow from the base. The copy on the default branch is the one that executes. For release-please the built-in token has a known cost: events created with GITHUB_TOKEN do not trigger workflows, so the release PR will not run the pull_request checks. Noted in the file. --- .github/workflows/auto-author-assign.yml | 12 +++++++++++- .github/workflows/release-please.yml | 14 ++++++++++---- 2 files changed, 21 insertions(+), 5 deletions(-) diff --git a/.github/workflows/auto-author-assign.yml b/.github/workflows/auto-author-assign.yml index 9dda4fa..57675fd 100644 --- a/.github/workflows/auto-author-assign.yml +++ b/.github/workflows/auto-author-assign.yml @@ -13,4 +13,14 @@ jobs: steps: - uses: toshimaru/auto-author-assign@v3.1.0 with: - repo-token: ${{ secrets.GH_PAT }} + # `GH_PAT` is not configured on this repo, so this input resolved to an empty string + # and the action failed with 'Input required and not supplied: repo-token' on every + # pull request. `github.token` is always populated, and the job already holds the + # `pull-requests: write` permission the action needs. + # + # This has to be fixed *on master*. Two earlier attempts (908f19a, a88de87) changed + # this file on a feature branch and had no effect: `pull_request_target` did not use + # the base branch's copy of the workflow — PRs whose base already carried a working + # token still failed with the empty-input error — so the definition that runs is the + # one on the default branch. Changing it anywhere else is invisible. + repo-token: ${{ secrets.GH_PAT || github.token }} diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 32cae12..7a7faf2 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -15,7 +15,13 @@ jobs: steps: - uses: googleapis/release-please-action@v5 with: - # this assumes that you have created a personal access token - # (PAT) and configured it as a GitHub action secret named - # `MY_RELEASE_PLEASE_TOKEN` (this secret name is not important). - token: ${{ secrets.GH_PAT }} + # `GH_PAT` is not configured on this repo, so this resolved to an empty string and + # every push to master failed with 'release-please failed: Input required and not + # supplied: token'. `github.token` is always populated and the job is granted the + # `contents: write` and `pull-requests: write` it needs. + # + # Known limitation of the built-in token, and the reason a PAT is the usual advice: + # events created with `GITHUB_TOKEN` do not trigger workflows, so the release PR + # release-please opens will not run the `pull_request` checks. The release itself is + # unaffected. Set `GH_PAT` on the repo or org and it takes precedence automatically. + token: ${{ secrets.GH_PAT || github.token }}