From 05f7b618e53f6a816535d7b5eacf85fd73be59d0 Mon Sep 17 00:00:00 2001 From: razbroc Date: Thu, 27 Aug 2026 09:38:50 +0300 Subject: [PATCH 1/2] ci: give the workflow tokens a value that exists Both failing workflows failed for the same reason: `secrets.GH_PAT` is not configured on this repo, so the input resolved to an empty string and the action refused to start. PR Author Auto Assign Input required and not supplied: repo-token release-please release-please failed: Input required and not supplied: token Both now prefer `GH_PAT` and fall back to `github.token`, which is always populated. Each job already holds the permissions its action needs, so nothing depends on a secret being set. If the org sets `GH_PAT` later it takes precedence with no further change. This has to land on master to take effect. 908f19a and a88de87 both changed auto-author-assign.yml on a feature branch and neither ran: pull requests whose base branch already carried a working token still failed with the empty-input error, so `pull_request_target` is not resolving the workflow from the base. The copy on the default branch is the one that executes. For release-please the built-in token has a known cost: events created with GITHUB_TOKEN do not trigger workflows, so the release PR will not run the pull_request checks. Noted in the file. --- .github/workflows/auto-author-assign.yml | 12 +++++++++++- .github/workflows/release-please.yml | 14 ++++++++++---- 2 files changed, 21 insertions(+), 5 deletions(-) diff --git a/.github/workflows/auto-author-assign.yml b/.github/workflows/auto-author-assign.yml index 9dda4fa..57675fd 100644 --- a/.github/workflows/auto-author-assign.yml +++ b/.github/workflows/auto-author-assign.yml @@ -13,4 +13,14 @@ jobs: steps: - uses: toshimaru/auto-author-assign@v3.1.0 with: - repo-token: ${{ secrets.GH_PAT }} + # `GH_PAT` is not configured on this repo, so this input resolved to an empty string + # and the action failed with 'Input required and not supplied: repo-token' on every + # pull request. `github.token` is always populated, and the job already holds the + # `pull-requests: write` permission the action needs. + # + # This has to be fixed *on master*. Two earlier attempts (908f19a, a88de87) changed + # this file on a feature branch and had no effect: `pull_request_target` did not use + # the base branch's copy of the workflow — PRs whose base already carried a working + # token still failed with the empty-input error — so the definition that runs is the + # one on the default branch. Changing it anywhere else is invisible. + repo-token: ${{ secrets.GH_PAT || github.token }} diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 32cae12..7a7faf2 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -15,7 +15,13 @@ jobs: steps: - uses: googleapis/release-please-action@v5 with: - # this assumes that you have created a personal access token - # (PAT) and configured it as a GitHub action secret named - # `MY_RELEASE_PLEASE_TOKEN` (this secret name is not important). - token: ${{ secrets.GH_PAT }} + # `GH_PAT` is not configured on this repo, so this resolved to an empty string and + # every push to master failed with 'release-please failed: Input required and not + # supplied: token'. `github.token` is always populated and the job is granted the + # `contents: write` and `pull-requests: write` it needs. + # + # Known limitation of the built-in token, and the reason a PAT is the usual advice: + # events created with `GITHUB_TOKEN` do not trigger workflows, so the release PR + # release-please opens will not run the `pull_request` checks. The release itself is + # unaffected. Set `GH_PAT` on the repo or org and it takes precedence automatically. + token: ${{ secrets.GH_PAT || github.token }} From 14333ef58f53cf6887fe5b93d97bd5b291933f50 Mon Sep 17 00:00:00 2001 From: razbroc Date: Tue, 15 Sep 2026 12:29:46 +0300 Subject: [PATCH 2/2] docs: trim the token-fallback comments GH_PAT turned out to be configured after all (the org secret is granted to this repo), so the long write-up about it being missing was wrong. Keep just the one line that says why the fallback is there. --- .github/workflows/auto-author-assign.yml | 11 +---------- .github/workflows/release-please.yml | 12 +++--------- 2 files changed, 4 insertions(+), 19 deletions(-) diff --git a/.github/workflows/auto-author-assign.yml b/.github/workflows/auto-author-assign.yml index 57675fd..006b5f4 100644 --- a/.github/workflows/auto-author-assign.yml +++ b/.github/workflows/auto-author-assign.yml @@ -13,14 +13,5 @@ jobs: steps: - uses: toshimaru/auto-author-assign@v3.1.0 with: - # `GH_PAT` is not configured on this repo, so this input resolved to an empty string - # and the action failed with 'Input required and not supplied: repo-token' on every - # pull request. `github.token` is always populated, and the job already holds the - # `pull-requests: write` permission the action needs. - # - # This has to be fixed *on master*. Two earlier attempts (908f19a, a88de87) changed - # this file on a feature branch and had no effect: `pull_request_target` did not use - # the base branch's copy of the workflow — PRs whose base already carried a working - # token still failed with the empty-input error — so the definition that runs is the - # one on the default branch. Changing it anywhere else is invisible. + # Fall back to the built-in token so the job still works if GH_PAT is unset. repo-token: ${{ secrets.GH_PAT || github.token }} diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 7a7faf2..159d646 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -15,13 +15,7 @@ jobs: steps: - uses: googleapis/release-please-action@v5 with: - # `GH_PAT` is not configured on this repo, so this resolved to an empty string and - # every push to master failed with 'release-please failed: Input required and not - # supplied: token'. `github.token` is always populated and the job is granted the - # `contents: write` and `pull-requests: write` it needs. - # - # Known limitation of the built-in token, and the reason a PAT is the usual advice: - # events created with `GITHUB_TOKEN` do not trigger workflows, so the release PR - # release-please opens will not run the `pull_request` checks. The release itself is - # unaffected. Set `GH_PAT` on the repo or org and it takes precedence automatically. + # Fall back to the built-in token so the job still works if GH_PAT is unset. + # Note: with the built-in token the release PR will not run the pull_request + # checks, because events created by GITHUB_TOKEN do not trigger workflows. token: ${{ secrets.GH_PAT || github.token }}