queue filing: open the PR with a QUEUE_PR_TOKEN secret when the repo setting is out of reach

.github/workflows/queue_filing.yml

@@ -23,14 +23,19 @@ name: Queue filing
 # workflows (validate.yml) do NOT run on it — `make validate` + pytest run
 # here as the gate instead, before anything is pushed.
 #
-# **The PR needs one repo setting.** GITHUB_TOKEN may open a PR only when
-# "Allow GitHub Actions to create and approve pull requests" is on
-# (Settings → Actions → General → Workflow permissions). Off, the filing
-# still lands on its `queue-filing/issue-<n>` branch, gated, and the issue
-# gets a one-tap compare link instead of a PR — but nothing reaches `main`
-# until a human opens and merges it, and the board's *Filings awaiting
-# merge* section is where those branches wait. Three did, unnoticed, between
-# 2026-09-01 and 2026-09-10; the setting is the fix.
+# **Opening the PR needs a token that is allowed to.** GITHUB_TOKEN may open
+# a PR only when "Allow GitHub Actions to create and approve pull requests"
+# is on (Settings → Actions → General → Workflow permissions — and when the
+# organisation enforces that setting the repo page does not even show it).
+# So the PR step prefers a `QUEUE_PR_TOKEN` repo secret when one exists: a
+# fine-grained personal access token scoped to this repo with *Pull
+# requests: read and write* (plus the metadata read it gets by default).
+# A PR opened with it also runs validate.yml, which a GITHUB_TOKEN-created
+# PR never does. Without either, the filing still lands on its
+# `queue-filing/issue-<n>` branch, gated, and the issue gets a one-tap
+# compare link instead of a PR — but nothing reaches `main` until a human
+# opens and merges it, and the board's *Filings awaiting merge* section is
+# where those branches wait. Six did between 2026-09-01 and 2026-09-11.
 #
 # A second tap on the same paper does not file it twice: a filing branch
 # that already exists for this issue, or for another open issue naming the
@@ -302,6 +307,10 @@ jobs:
 
       - name: Branch, commit, push, open the PR (explicit paths only)
         if: steps.resolve.outputs.skip != 'yes' && steps.dup.outputs.skip != 'yes'
+        env:
+          # Empty when the secret is not set; the PR step then falls back to
+          # the job token and the repo setting decides (header above).
+          PR_TOKEN: ${{ secrets.QUEUE_PR_TOKEN }}
         run: |
           git config user.name  "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
@@ -325,7 +334,7 @@ jobs:
             echo
             echo "Closes #${ISSUE}."
           } > /tmp/pr_body.md
-          if gh pr create --base main --head "$branch" \
+          if GH_TOKEN="${PR_TOKEN:-$GH_TOKEN}" gh pr create --base main --head "$branch" \
               --title "queue filing: paper from #${ISSUE}" \
               --body-file /tmp/pr_body.md; then
             gh issue comment "$ISSUE" --body \
@@ -336,7 +345,7 @@ jobs:
             # The board lists the branch under "Filings awaiting merge" until
             # it lands or is deleted.
             gh issue comment "$ISSUE" --body \
-              "Filing branch pushed and gated: \`${branch}\` — but this repo's policy blocks Actions from opening PRs. Open it with one tap: ${GITHUB_SERVER_URL}/${GH_REPO}/compare/main...${branch}?expand=1 — or enable 'Allow GitHub Actions to create and approve pull requests' (Settings → Actions → General) to make this automatic. Until it is merged, the paper is on that branch and not in memory; the dashboard lists it under *Filings awaiting merge*."
+              "Filing branch pushed and gated: \`${branch}\` — but this repo's policy blocks Actions from opening PRs. Open it with one tap: ${GITHUB_SERVER_URL}/${GH_REPO}/compare/main...${branch}?expand=1 — or make this automatic by adding a \`QUEUE_PR_TOKEN\` repo secret (a fine-grained PAT with pull-requests write on this repo; see queue_filing.yml's header). Until it is merged, the paper is on that branch and not in memory; the dashboard lists it under *Filings awaiting merge*."
           fi
 
       - name: Report failure on the issue

README.md

@@ -29,8 +29,10 @@ The per-paper buttons file GitHub issues that two workflows act on:
 `queue_actions.yml` makes the mechanical moves (➕ ✅ ✖️ 🧹) and closes the
 issue; `queue_filing.yml` has Claude file a 📥/📑 paper onto a
 `queue-filing/issue-<n>` branch, gated, for a human to merge — and it opens
-that PR itself only once *Allow GitHub Actions to create and approve pull
-requests* is on (Settings → Actions → General). A tap whose label the issue
+that PR itself when a `QUEUE_PR_TOKEN` repo secret (a fine-grained PAT with
+pull-requests write on this repo) exists, or when *Allow GitHub Actions to
+create and approve pull requests* is on (Settings → Actions → General). A tap
+whose label the issue
 form dropped is read from its title; whatever nothing acted on is
 re-dispatched by the nightly `queue_sweep.yml`; and a filing that reached its
 branch but not `main` sits at the top of the board under **Filings awaiting