From d04d36f26f2e736a0599f78219db3f72bbe6ad02 Mon Sep 17 00:00:00 2001
From: Georgie Kennedy <georgina.kennedy@unsw.edu.au>
Date: Thu, 3 Sep 2026 14:09:41 +1000
Subject: [PATCH] adding token handling for repos that need to handle private
 sibling repo dependencies

---
 .github/workflows/build-test.yml | 22 ++++++++++++++++++++++
 docs/workflows/build-test.md     | 24 ++++++++++++++++++++++++
 2 files changed, 46 insertions(+)

diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml
index 122e440..820cbc5 100644
--- a/.github/workflows/build-test.yml
+++ b/.github/workflows/build-test.yml
@@ -24,6 +24,18 @@ on:
         type: string
         default: 'src/'
         required: false
+      sibling-repos:
+        description: >
+          Newline-separated repository names to check out as real siblings
+          before `uv sync`, for private path dependencies not published to
+          PyPI. Requires the `token` secret.
+        type: string
+        default: ''
+        required: false
+    secrets:
+      token:
+        description: Fine-grained PAT with Contents:read on the sibling repos — only needed if sibling-repos is set
+        required: false
 
 jobs:
   test:
@@ -33,6 +45,16 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Checkout sibling repos
+        if: inputs.sibling-repos != ''
+        env:
+          GH_TOKEN: ${{ secrets.token }}
+        run: |
+          while IFS= read -r repo; do
+            [ -z "$repo" ] && continue
+            git clone --quiet "https://x-access-token:${GH_TOKEN}@github.com/AustralianCancerDataNetwork/${repo}" "../${repo}"
+          done <<< "${{ inputs.sibling-repos }}"
+
       - uses: astral-sh/setup-uv@v5
         with:
           python-version: ${{ inputs.python-version }}
diff --git a/docs/workflows/build-test.md b/docs/workflows/build-test.md
index 89c8d15..7a812a6 100644
--- a/docs/workflows/build-test.md
+++ b/docs/workflows/build-test.md
@@ -18,6 +18,13 @@ The check name is `{calling-job-name} / test`. If you name the calling job diffe
 | `ruff` | boolean | `true` | Whether to run `ruff check .` |
 | `setup-commands` | string | `''` | Shell commands to run before tests (YAML block scalar, no script file needed) |
 | `ty-src` | string | `src/` | Path passed to `ty check` for type checking |
+| `sibling-repos` | string | `''` | Newline-separated private repository names to check out as siblings before `uv sync` |
+
+## Secrets
+
+| Secret | Required | Description |
+|---|---|---|
+| `token` | only if `sibling-repos` is set | Fine-grained PAT with Contents:read on the sibling repositories |
 
 ## Usage
 
@@ -40,3 +47,20 @@ jobs:
           --test-host localhost \
           --test-port 5432
 ```
+
+With a private sibling dependency:
+
+```yaml
+jobs:
+  build-test:
+    uses: AustralianCancerDataNetwork/cava-devops/.github/workflows/build-test.yml@main
+    with:
+      sibling-repos: |
+        ohdsi-prompt-registry
+    secrets:
+      token: ${{ secrets.CAVA_DEVOPS_TOKEN }}
+```
+
+The sibling is checked out with full history at `../ohdsi-prompt-registry`, so
+an editable `[tool.uv.sources]` path dependency resolves before `uv sync` and
+`hatch-vcs` can determine its version.