From 9f7f5a4dc3c8a8925fbdab397cea2eebfaa62172 Mon Sep 17 00:00:00 2001 From: Andy Scherzinger Date: Mon, 6 Jul 2026 15:51:57 +0200 Subject: [PATCH] ci: Update policy check to org-latest Signed-off-by: Andy Scherzinger --- .github/workflows/ai-policy.yml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ai-policy.yml b/.github/workflows/ai-policy.yml index e5c8d7d6520..4b4653ee67a 100644 --- a/.github/workflows/ai-policy.yml +++ b/.github/workflows/ai-policy.yml @@ -32,7 +32,9 @@ jobs: - name: Collect PR commit messages id: collect env: - GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT }} + # Fall back to the default token when the PAT is unavailable + # (e.g. Dependabot- or fork-triggered runs don't receive Actions secrets) + GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT || github.token }} COMMITS_URL: ${{ github.event.pull_request.commits_url }} run: | set -euo pipefail @@ -125,7 +127,9 @@ jobs: - name: Create 'AI assisted' label if absent if: steps.ai_trailers.outputs.ai_assisted == 'true' || steps.agent_signoff.outputs.agent_signoff == 'true' || steps.co_authored.outputs.co_authored == 'true' env: - GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT }} + # Fall back to the default token when the PAT is unavailable + # (e.g. Dependabot- or fork-triggered runs don't receive Actions secrets) + GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT || github.token }} run: | gh api "repos/${{ github.repository }}/labels" \ --method POST \ @@ -137,7 +141,9 @@ jobs: - name: Label PR as AI assisted if: steps.ai_trailers.outputs.ai_assisted == 'true' || steps.agent_signoff.outputs.agent_signoff == 'true' || steps.co_authored.outputs.co_authored == 'true' env: - GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT }} + # Fall back to the default token when the PAT is unavailable + # (e.g. Dependabot- or fork-triggered runs don't receive Actions secrets) + GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT || github.token }} run: | gh api "repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels" \ --method POST \