fix: Use MANIFEST_REPO_PAT for supersede detection API calls

[JesperTerkelsen]

Summary

FIX: Use MANIFEST_REPO_PAT for GitHub API access in supersede detection to fix 404 errors.

Problem

ArgoCD wait-sync action is failing with 404 errors when checking commit ancestry for supersede detection.

Error Example: https://github.com/monta-app/service-i18n/actions/runs/21032367040/job/60471830591

Error Message:

Warning: Failed to check commit ancestry (exit code: 1)
Response: {"message":"Not Found","documentation_url":"https://docs.github.com/rest/commits/commits#compare-two-commits","status":"404"}
gh: Not Found (HTTP 404)

Root Cause: The automatic secrets.GITHUB_TOKEN only has access to the repository running the workflow. For supersede detection, the action needs to query the manifest repository (kube-manifests or service repos) using the GitHub Compare API, which requires cross-repo access.

Solution

Change from secrets.GITHUB_TOKEN to secrets.MANIFEST_REPO_PAT:

• MANIFEST_REPO_PAT is a Personal Access Token with cross-repo permissions
• It's already used in both workflows for checking out and pushing to manifest repositories
• It has the necessary permissions to call the Compare API on manifest repos

Changes

component-deploy.yml (line 188)

- name: Wait for ArgoCD sync
  with:
    github-token: ${{ secrets.MANIFEST_REPO_PAT }}  # Changed from secrets.GITHUB_TOKEN

component-deploy-v2.yml (line 198)

- name: Wait for ArgoCD sync
  with:
    github-token: ${{ secrets.MANIFEST_REPO_PAT }}  # Changed from secrets.GITHUB_TOKEN

Workflows Affected

This fix applies to:

• ✅ component-deploy.yml - Direct fix
• ✅ component-deploy-v2.yml - Direct fix
• ✅ deploy-kotlin.yml - Calls component-deploy.yml (line 246)
• ✅ deploy-generic-v2.yml - Calls component-deploy-v2.yml
• ✅ Any other workflow calling these component workflows

All workflows already pass MANIFEST_REPO_PAT as a required secret, so no changes needed to calling workflows.

Why This Works

• secrets.GITHUB_TOKEN: Automatic token, only has access to current repo
• secrets.MANIFEST_REPO_PAT: Personal Access Token with multi-repo access
• MANIFEST_REPO_PAT is already a required secret in both workflows
• It's already used for actions/checkout and github-push-action
• No new secrets or configuration needed

Impact

✅ Fixes 404 errors - Supersede detection can now query manifest repos
✅ No breaking changes - MANIFEST_REPO_PAT is already required
✅ Consistent with existing usage - Same token used for other manifest repo operations
✅ Applies to all deploy workflows - deploy-kotlin, deploy-generic-v2, and all callers

Testing

After merge, supersede detection will work correctly without 404 errors when checking commit ancestry across repositories.

🤖 Generated with Claude Code