tools: use the read-only token when filtering PRs in CQ

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/65169
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
This commit is contained in:
Antoine du Hamel authored and GitHub committed 2026-08-09 19:26:21 +00:00
1 parent 8f518788f9
commit 2b7766ed47
1 file changed
+9 -5
+9 -5
View File
@@ -58,6 +58,8 @@ jobs:
commitQueue:
needs: get_candidate_prs
if: needs.get_candidate_prs.outputs.candidates != ''
permissions:
pull-requests: read
runs-on: ubuntu-slim
steps:
# Install dependencies
@@ -78,13 +80,13 @@ jobs:
ncu-config --global set branch "${GITHUB_REF_NAME}"
ncu-config --global set upstream origin
ncu-config --global set username "$USERNAME"
ncu-config --global set token "$GITHUB_TOKEN"
ncu-config --global set token "$GH_TOKEN"
ncu-config --global set jenkins_token "$JENKINS_TOKEN"
ncu-config --global set repo "${REPOSITORY}"
ncu-config --global set owner "${GITHUB_REPOSITORY_OWNER}"
env:
USERNAME: ${{ secrets.JENKINS_USER }}
GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
GH_TOKEN: ${{ github.token }}
JENKINS_TOKEN: ${{ secrets.JENKINS_TOKEN }}
- name: Filter Pull Requests
@@ -154,7 +156,7 @@ jobs:
echo "numbers=$numbers" >> "$GITHUB_OUTPUT"
env:
CANDIDATES: ${{ needs.get_candidate_prs.outputs.candidates }}
GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
GH_TOKEN: ${{ github.token }}
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
if: steps.get_mergeable_prs.outputs.numbers != ''
@@ -167,6 +169,8 @@ jobs:
- name: Start the Commit Queue
if: steps.get_mergeable_prs.outputs.numbers != ''
run: ./tools/actions/commit-queue.sh "${GITHUB_REPOSITORY_OWNER}" "${REPOSITORY}" ${{ steps.get_mergeable_prs.outputs.numbers }}
run: |
ncu-config set token "$GH_TOKEN"
./tools/actions/commit-queue.sh "${GITHUB_REPOSITORY_OWNER}" "${REPOSITORY}" ${{ steps.get_mergeable_prs.outputs.numbers }}
env:
GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}