From 4f8e6db2cdc94306ede6bd8cc441dd59d862a8f3 Mon Sep 17 00:00:00 2001
From: opencode-probe <probe@tmp>
Date: Tue, 15 Sep 2026 17:23:29 -0400
Subject: [PATCH] Fix Depot governance runs: NODE_AUTH_TOKEN from
 GH_PACKAGES_TOKEN (.depot only)

Depot has no automatic GITHUB_TOKEN; the enforcer install E403d on
@wave-av/governance on every Depot run. Mirrors webhook-edge#50.
---
 .depot/workflows/governance-enforce.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.depot/workflows/governance-enforce.yml b/.depot/workflows/governance-enforce.yml
index b2df9ad..4662b00 100644
--- a/.depot/workflows/governance-enforce.yml
+++ b/.depot/workflows/governance-enforce.yml
@@ -55,7 +55,8 @@ jobs:
         # FIX 1 — token scoped to THIS STEP. At job level it was also in scope for the step that
         # executes the downloaded package, and for anything else the job ever grows.
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Depot has no automatic GITHUB_TOKEN: use the imported packages token.
+          NODE_AUTH_TOKEN: ${{ secrets.GH_PACKAGES_TOKEN }}
         run: |
           set -euo pipefail
           mkdir -p "$RUNNER_TEMP/gov" && cd "$RUNNER_TEMP/gov"