From 5cf1402555de4e9060aca71453d8259c0d40fe9c Mon Sep 17 00:00:00 2001 From: Lukasz Raczylo Date: Mon, 10 Aug 2026 10:25:57 +0100 Subject: [PATCH] fix(go-autoupdate): fall back to github.token when HOMEBREW_TAP_TOKEN is unset create-pull-request and the gh pr merge step both hard-required HOMEBREW_TAP_TOKEN, so any consumer repo without that secret got 'Input token not supplied' and the whole Autoupdate run failed. A same-repo PR needs only the caller's contents/pull-requests write; fall back to the auto-provisioned github.token. Consumers that do set the tap token keep current behavior. --- .github/workflows/go-autoupdate.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/go-autoupdate.yaml b/.github/workflows/go-autoupdate.yaml index 17f9e10..b7ddda3 100644 --- a/.github/workflows/go-autoupdate.yaml +++ b/.github/workflows/go-autoupdate.yaml @@ -67,7 +67,7 @@ jobs: if: steps.changes.outputs.changes_detected == 'true' uses: peter-evans/create-pull-request@v8 with: - token: ${{ secrets.HOMEBREW_TAP_TOKEN }} + token: ${{ secrets.HOMEBREW_TAP_TOKEN || github.token }} commit-message: "Update go.mod and go.sum" title: "Update Go dependencies" body: | @@ -82,4 +82,4 @@ jobs: if: steps.create-pr.outputs.pull-request-number run: gh pr merge --squash --delete-branch --admin "${{ steps.create-pr.outputs.pull-request-number }}" env: - GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }} + GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN || github.token }}