From becd1191f0ef8763979f3e68e6075dadab514d3a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Baki=20Burak=20=C3=96=C4=9F=C3=BCn?=
 <63836730+bakiburakogun@users.noreply.github.com>
Date: Sun, 30 Aug 2026 04:49:02 +0300
Subject: [PATCH] ci: fall back to github.token in the AI policy workflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Secrets are not exposed to pull requests from forks, so COMMAND_BOT_PAT is
empty there and the first step fails before it checks anything:

    gh: To use GitHub CLI in a GitHub Actions workflow, set the GH_TOKEN
    environment variable.
    Process completed with exit code 4

check-ai-trailers therefore fails on every PR from a fork, regardless of its
commits. The workflow already requests the permissions it needs, so the default
token can read the commit list.

This is what the organization template in nextcloud/.github already does, and
what nextcloud/spreed carries; this copy predates that change.

Signed-off-by: Baki Burak Öğün <63836730+bakiburakogun@users.noreply.github.com>
---
 .github/workflows/ai-policy.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ai-policy.yml b/.github/workflows/ai-policy.yml
index e5c8d7d6..ae981fa2 100644
--- a/.github/workflows/ai-policy.yml
+++ b/.github/workflows/ai-policy.yml
@@ -32,7 +32,7 @@ jobs:
       - name: Collect PR commit messages
         id: collect
         env:
-          GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT }}
+          GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT || github.token }}
           COMMITS_URL: ${{ github.event.pull_request.commits_url }}
         run: |
           set -euo pipefail
@@ -125,7 +125,7 @@ jobs:
       - name: Create 'AI assisted' label if absent
         if: steps.ai_trailers.outputs.ai_assisted == 'true' || steps.agent_signoff.outputs.agent_signoff == 'true' || steps.co_authored.outputs.co_authored == 'true'
         env:
-          GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT }}
+          GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT || github.token }}
         run: |
           gh api "repos/${{ github.repository }}/labels" \
             --method POST \
@@ -137,7 +137,7 @@ jobs:
       - name: Label PR as AI assisted
         if: steps.ai_trailers.outputs.ai_assisted == 'true' || steps.agent_signoff.outputs.agent_signoff == 'true' || steps.co_authored.outputs.co_authored == 'true'
         env:
-          GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT }}
+          GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT || github.token }}
         run: |
           gh api "repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels" \
             --method POST \