From a259d957b15c97381c86570080a4b173d657aefa Mon Sep 17 00:00:00 2001 From: Tam Nhu Tran Date: Mon, 2 Mar 2026 21:44:16 +0700 Subject: [PATCH] fix(ci): remove PAT dependency from release workflow checkouts --- .github/workflows/dev-release.yml | 4 ++-- .github/workflows/release.yml | 4 ++-- .github/workflows/sync-dev-after-release.yml | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/dev-release.yml b/.github/workflows/dev-release.yml index 09051a3c..e61a5661 100644 --- a/.github/workflows/dev-release.yml +++ b/.github/workflows/dev-release.yml @@ -26,8 +26,8 @@ jobs: uses: actions/checkout@v4 with: fetch-depth: 0 - # Prefer PAT when available (workflow-trigger compatibility), but never hard-fail when PAT is missing/expired. - token: ${{ secrets.PAT_TOKEN != '' && secrets.PAT_TOKEN || github.token }} + # Always use the built-in workflow token; PAT rotation/breakage must not block dev releases. + token: ${{ github.token }} - name: Setup Bun uses: oven-sh/setup-bun@v2 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 66767059..ae8b97d9 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -20,8 +20,8 @@ jobs: uses: actions/checkout@v4 with: fetch-depth: 0 - # Prefer PAT when available (workflow-trigger compatibility), but never hard-fail when PAT is missing/expired. - token: ${{ secrets.PAT_TOKEN != '' && secrets.PAT_TOKEN || github.token }} + # Always use the built-in workflow token; PAT rotation/breakage must not block releases. + token: ${{ github.token }} - name: Setup Node.js uses: actions/setup-node@v4 diff --git a/.github/workflows/sync-dev-after-release.yml b/.github/workflows/sync-dev-after-release.yml index f48a44eb..b89d1cdf 100644 --- a/.github/workflows/sync-dev-after-release.yml +++ b/.github/workflows/sync-dev-after-release.yml @@ -20,8 +20,8 @@ jobs: uses: actions/checkout@v4 with: fetch-depth: 0 - # Prefer PAT when available, but fall back to built-in token to avoid hard dependency on PAT rotation. - token: ${{ secrets.PAT_TOKEN != '' && secrets.PAT_TOKEN || github.token }} + # Always use built-in workflow token so PAT rotation never breaks sync jobs. + token: ${{ github.token }} - name: Configure Git run: |