Skip to content

Fix Depot governance runs (packages token) #77

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yakimoto merged 1 commit into from
Sep 15, 2026
Merged

Fix Depot governance runs (packages token) #77

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .depot/workflows/governance-enforce.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,8 @@ jobs:
# FIX 1 — token scoped to THIS STEP. At job level it was also in scope for the step that
# executes the downloaded package, and for anything else the job ever grows.
env:
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# Depot has no automatic GITHUB_TOKEN: use the imported packages token.
NODE_AUTH_TOKEN: ${{ secrets.GH_PACKAGES_TOKEN }}

@gitar-bot gitar-bot Bot Sep 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Edge Case: GH_PACKAGES_TOKEN must exist as a secret imported into Depot

This is the only reference to GH_PACKAGES_TOKEN anywhere in the repo, and Depot secret configuration lives outside this checkout (in Depot's project settings), so it can't be verified from the repo whether this secret is actually imported there. If it isn't configured, the step will still fail (empty token in .npmrc), reproducing the same E403 this PR is meant to fix — worth a quick confirmation in Depot's dashboard before merging, or a note in the PR description confirming it's already set up.

Was this helpful? React with 👍 / 👎

@codeant-ai codeant-ai Bot Sep 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: Fork pull request workflows do not receive repository secrets, so GH_PACKAGES_TOKEN is empty and the private package install fails before governance enforcement runs. [api mismatch]

Assessment: 🟠 Major · 🔁 Occurrence: Sometimes

Use CodeAnt Skill Fix in Cursor Fix in VSCode Claude

Prompt for AI Agent 🤖 
This is a comment left during a code review.

**Path:** .depot/workflows/governance-enforce.yml
**Line:** 59:59
**Comment:**
	*Api Mismatch: Fork pull request workflows do not receive repository secrets, so `GH_PACKAGES_TOKEN` is empty and the private package install fails before governance enforcement runs.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
👍 | 👎

run: |
set -euo pipefail
mkdir -p "$RUNNER_TEMP/gov" && cd "$RUNNER_TEMP/gov"
Expand Down
Loading