Repository navigation
skills-update drops its token secret fallback (pre-MIP-0086) #148
Description
What
.github/workflows/skills-update.yml still declares an optional token secret and reads
steps.app.outputs.token || secrets.token || github.token (:31, :75). #132 removed the same
fallback from notify-umbrella and gemini-review. No caller passes token: to skills-update today (marola-site passes
pr_bot_key; marola passes nothing and gets GITHUB_TOKEN), so the removal breaks no one, and GITHUB_TOKEN stays the
no-key path. Remove the secret and the middle fallback; update the docs that list it and add a CHANGELOG line
(breaking only for a caller that passes token:).
Acceptance criteria
-
grep -n 'secrets.token' .github/workflows/skills-update.ymlprints nothing - docs and CHANGELOG updated;
just qualitygreen
Named test
just quality; a skills-update run in a consumer after the bump (run link).
Found while reviewing #132. Parent: marola-dev/marola#787. Not a blocker of #765 (the fallback ends at GITHUB_TOKEN).
Metadata
Metadata
Assignees
Labels
Type
Projects
- Status
Activity
release: v0.17.0 (#175)
brunogbv commentedon Oct 17, 2026
Proof, 2026-10-17. Shipped in marola-devkit v0.17.0 (PR #170, release #175, tag on b804e73). marola-site's bump to v0.17.0 (marola-dev/marola-site#162) merged at 12:28:31Z, unattended.
Named test: a skills-update run in a consumer after the bump. marola-site's
skills.yml(skills-update.yml@v0.17.0, passes onlypr_bot_key) dispatched at 12:32Z: run 39032904122, success. Steps:marola-pr-bot tokensuccess, both checkouts success,skills-vendor update --all …success withevery skill is at its pin, so no PR was opened or refreshed. The workflow no longer declarestoken, and no caller passes it (marola, marola-site, the devkit's ownskills.yml).