ci(auto-format): push and record success with the REPO_AUTOMATION_TOKEN PAT

.github/workflows/auto-format.yml

@@ -21,6 +21,13 @@ name: auto-format
 # missing, stale, or not an ancestor of HEAD, the run falls back to
 # the last 25 hours of changed files, and a failed variable update
 # only means the next run re-checks the same range.
+#
+# Pushes and variable writes use the REPO_AUTOMATION_TOKEN secret
+# (fine-grained PAT "developing-today-code-automation", this repo
+# only): the default GITHUB_TOKEN cannot write repository variables
+# (no such key exists in the workflow permissions vocabulary) and
+# cannot push workflow files (#3118). The PAT does both, and its
+# pushes trigger downstream checks like a human push.
 
 on:
   schedule:
@@ -44,13 +51,15 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         with:
+          token: ${{ secrets.REPO_AUTOMATION_TOKEN }}
           fetch-depth: 0
 
       - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
 
       - name: Format changed files with treefmt and commit any fixes
         env:
           LAST_SUCCESS_SHA: ${{ vars.AUTO_FORMAT_LAST_SUCCESS_SHA }}
+          REPO_AUTOMATION_TOKEN: ${{ secrets.REPO_AUTOMATION_TOKEN }}
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
@@ -61,9 +70,9 @@ jobs:
           record_success() {
             local sha
             sha="$(git rev-parse HEAD)"
-            if gh api -X PATCH "repos/$GITHUB_REPOSITORY/actions/variables/AUTO_FORMAT_LAST_SUCCESS_SHA" -f name="AUTO_FORMAT_LAST_SUCCESS_SHA" -f value="$sha" >/dev/null 2>&1; then
+            if GH_TOKEN="$REPO_AUTOMATION_TOKEN" gh api -X PATCH "repos/$GITHUB_REPOSITORY/actions/variables/AUTO_FORMAT_LAST_SUCCESS_SHA" -f name="AUTO_FORMAT_LAST_SUCCESS_SHA" -f value="$sha" >/dev/null 2>&1; then
               echo "Recorded AUTO_FORMAT_LAST_SUCCESS_SHA=$sha"
-            elif gh api -X POST "repos/$GITHUB_REPOSITORY/actions/variables" -f name="AUTO_FORMAT_LAST_SUCCESS_SHA" -f value="$sha" >/dev/null 2>&1; then
+            elif GH_TOKEN="$REPO_AUTOMATION_TOKEN" gh api -X POST "repos/$GITHUB_REPOSITORY/actions/variables" -f name="AUTO_FORMAT_LAST_SUCCESS_SHA" -f value="$sha" >/dev/null 2>&1; then
               echo "Created AUTO_FORMAT_LAST_SUCCESS_SHA=$sha"
             else
               echo "::warning::could not update AUTO_FORMAT_LAST_SUCCESS_SHA; the next run will re-check this range."
@@ -93,28 +102,10 @@ jobs:
             record_success
             exit 0
           fi
-          # The bot pushes with the default GITHUB_TOKEN, which lacks
-          # workflow authorization: staging a workflow formatting diff
-          # rejects the whole push and loses the unrelated fixes with
-          # it (#3118). Workflow files are excluded from this write
-          # pass only; treefmt still formats them everywhere else.
-          format_files=()
-          skipped_workflow_files=()
-          for f in "${changed_files[@]}"; do
-            case "$f" in
-              .github/workflows/*) skipped_workflow_files+=("$f") ;;
-              *) format_files+=("$f") ;;
-            esac
-          done
-          if ((${#skipped_workflow_files[@]} > 0)); then
-            printf 'Skipping workflow file(s) the bot cannot push:\n'
-            printf '  %s\n' "${skipped_workflow_files[@]}"
-          fi
-          if ((${#format_files[@]} == 0)); then
-            echo "Only workflow files changed; nothing for the auto-format bot to push."
-            record_success
-            exit 0
-          fi
+          # The push authenticates with the REPO_AUTOMATION_TOKEN
+          # PAT (see header), which may push workflow files, so
+          # nothing is excluded from the write pass.
+          format_files=("${changed_files[@]}")
           printf 'Formatting %s file(s):\n' "${#format_files[@]}"
           printf '  %s\n' "${format_files[@]}"
           nix run .#format -- "${format_files[@]}"