From bbc7cc6f7f52ee95b4d35316695fbd9d34859cc5 Mon Sep 17 00:00:00 2001 From: Nicolas Grekas Date: Fri, 29 May 2026 18:22:54 +0200 Subject: [PATCH] [ci] Fix BOT_TOKEN auth for Flex endpoint push and PR diff comment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous attempt still failed: - The Flex push embedded the token in the URL, but actions/checkout had persisted an http..extraheader Authorization for the default GITHUB_TOKEN, which git sends in preference to the URL credentials — so the push authenticated as github-actions[bot] and got 403. Unset that header before pushing so the BOT_TOKEN in the URL is used. - marocchino/sticky-pull-request-comment reads the token from its GITHUB_TOKEN input (default github.token), not the env var, so the read-only default token was still used. Pass it via "with:" instead. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/callable-qa.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/callable-qa.yml b/.github/workflows/callable-qa.yml index dcc897b5..e381fd8e 100644 --- a/.github/workflows/callable-qa.yml +++ b/.github/workflows/callable-qa.yml @@ -68,6 +68,7 @@ jobs: mv .github/flex-endpoint/*.json . git add *.json git commit -m 'Create Flex endpoint' || true + git config --local --unset-all http.https://github.com/.extraheader || true git push -f "https://x-access-token:${{ secrets.token }}@github.com/${{ github.repository }}" "flex/pull-${{ github.event.number }}" git switch pr git stash pop -q @@ -91,9 +92,8 @@ jobs: name: Post diff between recipe versions if: "always() && steps.checkout.outcome == 'success'" uses: marocchino/sticky-pull-request-comment@v2 - env: - GITHUB_TOKEN: ${{ secrets.token }} with: + GITHUB_TOKEN: ${{ secrets.token }} path: .github/diff-recipe-versions.md -