From ac9e39d2d6bce4b3cc56d899b5ddfc9544ca2c8a Mon Sep 17 00:00:00 2001 From: tommasini Date: Tue, 11 Aug 2026 02:00:05 +0100 Subject: [PATCH] fix: pass github-token to primary checkout in stable-sync action The main repo checkout step didn't forward the elevated github-token input to actions/checkout, so it silently fell back to the caller's default GITHUB_TOKEN for persisted git credentials. When a consuming workflow scopes its job-level permissions down to just id-token: write (as metamask-mobile's stable-branch-sync.yml does after migrating to OIDC token exchange), that default token has no contents:write, and the branch push later in this action fails with a 403: remote: Permission to MetaMask/metamask-mobile.git denied to github-actions[bot]. fatal: unable to access '...': The requested URL returned error: 403 Since the push fails, the subsequent "Create Pull Request" step is skipped, so no stable -> main sync PR ever gets opened. This mirrors the sibling release-branch-sync action, which already passes token: ${{ inputs.github-token }} on its primary checkout. Co-authored-by: Cursor --- .github/actions/stable-sync/action.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/actions/stable-sync/action.yml b/.github/actions/stable-sync/action.yml index 3be8a6df..76c73178 100644 --- a/.github/actions/stable-sync/action.yml +++ b/.github/actions/stable-sync/action.yml @@ -31,6 +31,7 @@ runs: - uses: actions/checkout@v6 with: fetch-depth: 0 + token: ${{ inputs.github-token }} - name: Checkout GitHub tools repository uses: actions/checkout@v6