mirror of
https://github.com/Mudlet/Mudlet
synced 2026-08-13 18:26:27 -04:00
c2d3561c0b
#### Brief overview of PR changes/additions - The add-milestone check now fails on every PR: the Mudlet org forbids fine-grained PATs with a lifetime over 366 days, so every API call made with `GH_PAT_UPDATE_PULL_REQUESTS` returns HTTP 403. The old workflow swallowed this with unchecked `curl -s`; the strict error handling from #9679 (infrastructure: fix milestone assignment, unbreak the key sequence tests) surfaced it - first failure 25 minutes after that merge. - Switches the "Assign PR to milestone" step to the built-in `GITHUB_TOKEN`, which already works in this workflow (the milestone-resolving step uses it and succeeded in the failing runs). `pull_request_target` runs in the base repository, so it has write access with `issues: write` / `pull-requests: write` granted. - Removes the dependency on the `GH_PAT_UPDATE_PULL_REQUESTS` secret entirely, so no PAT needs re-minting and no future expiry can break this again. Note: because this runs on `pull_request_target`, the default-branch copy of the workflow executes - the fix only takes effect after merge, so the add-milestone check on this PR itself will still fail. #### Test case The failing run's own log shows `GITHUB_TOKEN` succeeding at the milestone-read step while the PAT step 403s, confirming the built-in token works where the PAT does not. Assisted-by: Claude:claude-fable-5 |
||
|---|---|---|
| .. | ||
| codeql | ||
| ISSUE_TEMPLATE | ||
| scripts | ||
| skills/open-pr | ||
| workflows | ||
| CODEOWNERS | ||
| codespell-wordlist.txt | ||
| copilot-instructions.md | ||
| dependabot.yml | ||
| pr-labeler.yml | ||
| PULL_REQUEST_TEMPLATE.md | ||
| repo-metadata.yml | ||