From bf918103cbae291d22913f274d41cc58dbf334ab Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 2 Aug 2026 08:33:41 +0000
Subject: [PATCH] fix(ci): hand the cross-repo token to github-script instead
 of requiring @actions/github
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`require('@actions/github')` is not resolvable from a github-script `script:`
block — the action bundles its dependencies, so the call dies at runtime with
MODULE_NOT_FOUND. Passing the token via `github-token:` makes the injected
`github` client the cross-repo one, and no second client is needed.

Found on the first run that got past parsing; the same run confirmed the
credential logging works (`CROSS_REPO_ISSUE_TOKEN: configured`).
---
 .changeset/fix-cross-repo-closer-require.md   | 18 ++++++++++++++++++
 .github/workflows/cross-repo-issue-closer.yml | 17 ++++++++++-------
 2 files changed, 28 insertions(+), 7 deletions(-)
 create mode 100644 .changeset/fix-cross-repo-closer-require.md

diff --git a/.changeset/fix-cross-repo-closer-require.md b/.changeset/fix-cross-repo-closer-require.md
new file mode 100644
index 000000000..9f3925e48
--- /dev/null
+++ b/.changeset/fix-cross-repo-closer-require.md
@@ -0,0 +1,18 @@
+---
+---
+
+fix(ci): hand the cross-repo token to github-script instead of requiring @actions/github
+
+Release-nothing: touches `.github/workflows/cross-repo-issue-closer.yml` only.
+
+`require('@actions/github')` is not resolvable from a github-script `script:`
+block — the action bundles its dependencies, so the call fails at runtime with
+`MODULE_NOT_FOUND`. The token is now handed to the action itself
+(`github-token:`), which makes the injected `github` client the cross-repo one,
+with `secrets.GITHUB_TOKEN` as the fallback so the report path can still
+comment on the pull request when no cross-repo credential is configured.
+
+Found on this workflow's first run that got past parsing. The run also
+confirmed the credential logging works — `CROSS_REPO_ISSUE_TOKEN: configured`
+followed by `Cross-repo targets: objectstack-ai/objectstack#4475` — so the
+job now fails at the last step rather than the first.
diff --git a/.github/workflows/cross-repo-issue-closer.yml b/.github/workflows/cross-repo-issue-closer.yml
index e5acd1d8d..e36ab7f46 100644
--- a/.github/workflows/cross-repo-issue-closer.yml
+++ b/.github/workflows/cross-repo-issue-closer.yml
@@ -48,6 +48,13 @@ jobs:
           # to the repository running the workflow, which is the whole problem.
           CROSS_REPO_TOKEN: ${{ secrets.CROSS_REPO_ISSUE_TOKEN }}
         with:
+          # Hand the cross-repo token to the action itself, so `github` IS the
+          # cross-repo client. `require('@actions/github')` does NOT work here:
+          # github-script bundles its dependencies and the module is not
+          # resolvable from the script scope (`MODULE_NOT_FOUND`, seen on this
+          # workflow's first successful-parse run). Falling back to
+          # GITHUB_TOKEN keeps the report path able to comment on this PR.
+          github-token: ${{ secrets.CROSS_REPO_ISSUE_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
             const body = context.payload.pull_request.body || '';
             const prUrl = context.payload.pull_request.html_url;
@@ -111,27 +118,23 @@ jobs:
               return;
             }
 
-            // A second client: `github` is bound to GITHUB_TOKEN, which has no
-            // write access outside this repository.
-            const crossRepo = require('@actions/github').getOctokit(token);
-
             for (const [key, t] of targets) {
               try {
-                const { data: issue } = await crossRepo.rest.issues.get({
+                const { data: issue } = await github.rest.issues.get({
                   owner: t.owner, repo: t.repo, issue_number: t.number,
                 });
                 if (issue.state === 'closed') {
                   core.info(`${key} is already closed — skipping.`);
                   continue;
                 }
-                await crossRepo.rest.issues.createComment({
+                await github.rest.issues.createComment({
                   owner: t.owner, repo: t.repo, issue_number: t.number,
                   body:
                     `已由 ${thisRepo} 的 ${prUrl} 修复并合并。\n\n` +
                     `（跨仓库的关闭关键字不会自动生效，本条由 \`cross-repo-issue-closer\` 工作流代为收口。）\n\n` +
                     `---\n_Generated by [Claude Code](https://claude.ai/code)_`,
                 });
-                await crossRepo.rest.issues.update({
+                await github.rest.issues.update({
                   owner: t.owner, repo: t.repo, issue_number: t.number,
                   state: 'closed', state_reason: 'completed',
                 });