From 305a2ad3758721e101b87acc28440b299d343304 Mon Sep 17 00:00:00 2001 From: Ray Date: Thu, 6 Aug 2026 14:26:26 +0800 Subject: [PATCH] ci(sync): require SYNC_PAT instead of silently falling back to github.token Signed-off-by: Ray --- .github/workflows/sync-upstream.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/sync-upstream.yml b/.github/workflows/sync-upstream.yml index 79d6395fb..6a9bb6813 100644 --- a/.github/workflows/sync-upstream.yml +++ b/.github/workflows/sync-upstream.yml @@ -32,12 +32,19 @@ jobs: sync: runs-on: ubuntu-latest steps: + - name: Require SYNC_PAT + run: | + if [ -z "${{ secrets.SYNC_PAT }}" ]; then + echo "::error::SYNC_PAT secret is not set. This workflow cannot push tags containing upstream workflow files without a PAT that has repo+workflow scope. Set SYNC_PAT (see README Sync SOP) — do not fall back to github.token." + exit 1 + fi + - name: Checkout this repo (full history + tags) uses: actions/checkout@v5 with: ref: upstream-main fetch-depth: 0 - token: ${{ secrets.SYNC_PAT || github.token }} + token: ${{ secrets.SYNC_PAT }} - name: Configure git identity run: |