From bdfcd935728e2014d8131c2b4abc0981786f79ba Mon Sep 17 00:00:00 2001
From: meh <no-reply@pathscale.com>
Date: Wed, 9 Sep 2026 16:20:31 +0700
Subject: [PATCH] fix(qa): the headless host action does not need a secret

chuzz is public, so `actions/checkout` reaches it with the workflow's own
`github.token`. The action nonetheless declared `token` as `required: true`,
so every caller had to name a secret to clone a public repository, and the
repositories that did not have `SIBLING_REPOS_TOKEN` passed the empty string.
The action then failed before its first step with

    Input required and not supplied: token

which names the input rather than the missing secret, and reads as a broken
action rather than an unset repository secret.

`token` is now optional, and the checkout falls back to `github.token` when
the input is empty, so a caller that still passes an unset secret works too.
That matters here: fifteen callers already pass one.
---
 .github/actions/headless-host/action.yml | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/.github/actions/headless-host/action.yml b/.github/actions/headless-host/action.yml
index f2133f2..8f600ac 100644
--- a/.github/actions/headless-host/action.yml
+++ b/.github/actions/headless-host/action.yml
@@ -9,9 +9,17 @@ inputs:
     default: master
   token:
     description: >
-      A token that can read pathscale/chuzz. Required, because the host is built
-      from source rather than installed from a registry.
-    required: true
+      A token that can read pathscale/chuzz. Optional: chuzz is public, so the
+      workflow's own `github.token` can check it out, and that is the default.
+      Supply one only to read a fork or a private mirror.
+
+      This was `required: true`, which meant every caller had to pass a secret
+      to clone a public repository. Callers that named a secret their
+      repository did not have passed the empty string, and the action failed
+      before its first step with "Input required and not supplied: token",
+      naming the input rather than the missing secret.
+    required: false
+    default: ""
   ps-qa-version:
     description: >
       The driver's version requirement. A floor rather than "latest": a check
@@ -37,7 +45,9 @@ runs:
         repository: pathscale/chuzz
         ref: ${{ inputs.chuzz-ref }}
         path: .qa-host
-        token: ${{ inputs.token }}
+        # `|| github.token` so a caller passing an unset secret, which arrives
+        # as the empty string, still gets a token that can read a public repo.
+        token: ${{ inputs.token || github.token }}
 
     - name: Install Rust
       uses: dtolnay/rust-toolchain@stable