From e8dc420b4dbf4398430c7b486c7c375286c0cabf Mon Sep 17 00:00:00 2001
From: Tom Boucher <trekkie@nomorestars.com>
Date: Thu, 4 Jun 2026 09:15:58 -0400
Subject: [PATCH] ci(#660): use scoped GSD_BOT_PR_TOKEN for backmerge & release
 merge-back PR creation (#673)

The open-gsd org blocks the Actions GITHUB_TOKEN from creating PRs, so
auto-backmerge and the release finalize merge-back PR steps can't open
their PRs (must be done manually). Point those two steps at a scoped
secret (pull-requests:write + contents:write), falling back to
GITHUB_TOKEN so behavior is unchanged until the secret is added.

Refs #660

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/auto-backmerge.yml | 4 ++--
 .github/workflows/release.yml        | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/auto-backmerge.yml b/.github/workflows/auto-backmerge.yml
index a907e7443..e94eb1502 100644
--- a/.github/workflows/auto-backmerge.yml
+++ b/.github/workflows/auto-backmerge.yml
@@ -56,7 +56,7 @@ jobs:
         if: steps.check.outputs.next_exists == 'true'
         id: branch
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ secrets.GSD_BOT_PR_TOKEN || secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
           SHORT_SHA=$(git rev-parse --short HEAD)
@@ -108,7 +108,7 @@ jobs:
       - name: Open or update PR
         if: steps.check.outputs.next_exists == 'true' && steps.branch.outputs.reused != 'true'
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ secrets.GSD_BOT_PR_TOKEN || secrets.GITHUB_TOKEN }}
           BR: ${{ steps.branch.outputs.branch }}
         run: |
           set -euo pipefail
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d04647649..806c694fa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -326,7 +326,7 @@ jobs:
         if: ${{ !inputs.dry_run }}
         continue-on-error: true
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ secrets.GSD_BOT_PR_TOKEN || secrets.GITHUB_TOKEN }}
           BRANCH: ${{ needs.validate-version.outputs.branch }}
           VERSION: ${{ inputs.version }}
         run: |