The previous attempt still failed:
- The Flex push embedded the token in the URL, but actions/checkout had
persisted an http.<host>.extraheader Authorization for the default
GITHUB_TOKEN, which git sends in preference to the URL credentials —
so the push authenticated as github-actions[bot] and got 403. Unset
that header before pushing so the BOT_TOKEN in the URL is used.
- marocchino/sticky-pull-request-comment reads the token from its
GITHUB_TOKEN input (default github.token), not the env var, so the
read-only default token was still used. Pass it via "with:" instead.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The default GITHUB_TOKEN is now read-only, so pushing the generated Flex
endpoint and posting the recipe-diff comment failed (403 / "Resource not
accessible by integration"). Authenticate both via the BOT_TOKEN without
persisting it into the checkout credentials.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Nicolas GrekasandClaude Opus 4.8
Jan RosierandGitHub
Christophe CoevoetandGitHub
Fabien Potencier
Ilya AntipenkoandNicolas Grekas