From dccaac6cdaac12a8b6dfc682e17f509726849dfe Mon Sep 17 00:00:00 2001 From: Nicolas Grekas Date: Fri, 29 May 2026 18:09:44 +0200 Subject: [PATCH] [ci] Use BOT_TOKEN for the Flex endpoint push and PR diff comment The default GITHUB_TOKEN is now read-only, so pushing the generated Flex endpoint and posting the recipe-diff comment failed (403 / "Resource not accessible by integration"). Authenticate both via the BOT_TOKEN without persisting it into the checkout credentials. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/callable-qa.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/callable-qa.yml b/.github/workflows/callable-qa.yml index 8a25ab41..dcc897b5 100644 --- a/.github/workflows/callable-qa.yml +++ b/.github/workflows/callable-qa.yml @@ -68,7 +68,7 @@ jobs: mv .github/flex-endpoint/*.json . git add *.json git commit -m 'Create Flex endpoint' || true - git push origin -f flex/pull-${{ github.event.number }} + git push -f "https://x-access-token:${{ secrets.token }}@github.com/${{ github.repository }}" "flex/pull-${{ github.event.number }}" git switch pr git stash pop -q @@ -91,6 +91,8 @@ jobs: name: Post diff between recipe versions if: "always() && steps.checkout.outcome == 'success'" uses: marocchino/sticky-pull-request-comment@v2 + env: + GITHUB_TOKEN: ${{ secrets.token }} with: path: .github/diff-recipe-versions.md