skills-update drops its token secret fallback (pre-MIP-0086)

.github/workflows/skills-update.yml

@@ -1,7 +1,7 @@
 # skills-update: re-vendor every skill in the caller's skills.lock at its upstream's newest commit
 # at least `min-age` days old, and keep one PR open on `branch` with the diffs as its body
 # (MIP-0080; docs/4-reference_workflows.md#skills-update). Nothing merges on its own.
-# A PR opened with the default GITHUB_TOKEN starts no CI; pass `pr_bot_key` (marola-pr-bot) or a PAT as `token`.
+# A PR opened with the default GITHUB_TOKEN starts no CI; pass `pr_bot_key` (marola-pr-bot).
 name: skills-update
 
 on:
@@ -28,9 +28,6 @@ on:
       pr_bot_key:
         description: "marola-pr-bot's private key; mints the token that pushes and opens the PR, so the PR starts CI"
         required: false
-      token:
-        description: "pushes the branch and opens the PR when pr_bot_key is absent; the default GITHUB_TOKEN otherwise"
-        required: false
 
 permissions:
   contents: write
@@ -72,7 +69,7 @@ jobs:
 
       - uses: actions/checkout@v7
         with:
-          token: ${{ steps.app.outputs.token || secrets.token || github.token }}
+          token: ${{ steps.app.outputs.token || github.token }}
 
       - uses: actions/checkout@v7
         with:
@@ -82,7 +79,7 @@ jobs:
 
       - name: skills-vendor update --all, then push the branch and open or refresh the PR
         env:
-          GH_TOKEN: ${{ steps.app.outputs.token || secrets.token || github.token }}
+          GH_TOKEN: ${{ steps.app.outputs.token || github.token }}
           BRANCH: ${{ inputs.branch }}
           LOCK: ${{ inputs.lock }}
           MIN_AGE: ${{ inputs.min-age }}

CHANGELOG.md

@@ -4,6 +4,12 @@ Each release moves `plugin.json`'s `version`, the flake package version and ever
 together. A consumer adopts one by bumping its flake input, its workflow `@v…`/`devkit-ref` and its
 marketplace `ref` at once.
 
+## Unreleased
+
+- **Breaking** for a caller that passes `token:` to `skills-update`: the secret is no longer declared,
+  so the caller's workflow fails at the bump. `skills-update` drops the `token` (old PAT) fallback and
+  uses `pr_bot_key`, else the default `GITHUB_TOKEN` (MIP-0086, #148).
+
 ## v0.16.0 — 2026-10-17
 
 - `wiring.py` reports a `/dispatches` call whose type it cannot read, and `--check` fails on it; `wiring.py --lint-devkit` fails on that, or on a `repository_dispatch` type no devkit workflow sends, in the devkit's own workflows, and devkit CI runs it on every PR (#163).

docs/4-reference_workflows.md

@@ -441,8 +441,8 @@ jobs:
 
 Secret `pr_bot_key`, optional: `marola-pr-bot`'s private key (`vars.PR_BOT_APP_ID` is its id). The
 workflow mints a token for the caller's repo and pushes and opens the PR with it, so the PR starts
-CI; a PR opened with the default `GITHUB_TOKEN` starts none. Secret `token`, optional: a PAT used
-when `pr_bot_key` is absent. With neither, the job behaves as before.
+CI. Without it, the job pushes and opens the PR with the default `GITHUB_TOKEN`, and that PR starts
+no CI. A caller that still passes `token` fails, because the secret is no longer declared (MIP-0086).
 
 ## bot-token (composite action)