From 656be7e185cd1e959450f27554beb3ebd7fd2941 Mon Sep 17 00:00:00 2001
From: Max Haarhaus <max@seekinsights.com>
Date: Mon, 10 Aug 2026 02:23:10 -0400
Subject: [PATCH] fix(ci): add token for skills-ref job

---
 .github/workflows/skills-ref.yml |  4 +++-
 scripts/skills-ref-badge.test.ts | 15 +++++++++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/skills-ref.yml b/.github/workflows/skills-ref.yml
index a053e4b..4cbd948 100644
--- a/.github/workflows/skills-ref.yml
+++ b/.github/workflows/skills-ref.yml
@@ -18,6 +18,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.RELEASE_PR_TOKEN }}
 
       - uses: actions/setup-python@v5
         with:
@@ -44,4 +46,4 @@ jobs:
             exit 0
           fi
           git commit -m "chore(badge): update skills-ref validation badge [skip ci]"
-          git push
\ No newline at end of file
+          git push
diff --git a/scripts/skills-ref-badge.test.ts b/scripts/skills-ref-badge.test.ts
index 3f7ae34..4b3c2e6 100644
--- a/scripts/skills-ref-badge.test.ts
+++ b/scripts/skills-ref-badge.test.ts
@@ -1,6 +1,13 @@
 import { describe, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
 import { buildBadgeJson } from "./skills-ref-badge";
 
+const skillsRefWorkflow = readFileSync(
+  join(import.meta.dir, "..", ".github/workflows/skills-ref.yml"),
+  "utf8",
+);
+
 describe("skills-ref-badge buildBadgeJson", () => {
   test("all skills valid -> green score badge", () => {
     expect(buildBadgeJson(8, 8)).toEqual({
@@ -30,3 +37,11 @@ describe("skills-ref-badge buildBadgeJson", () => {
     });
   });
 });
+
+describe("skills-ref badge workflow", () => {
+  test("authenticates protected-branch pushes with the release token", () => {
+    expect(skillsRefWorkflow).toMatch(
+      /- uses: actions\/checkout@v4\n\s+with:\n\s+token: \$\{\{ secrets\.RELEASE_PR_TOKEN \}\}/,
+    );
+  });
+});