From 2a067b1c87d9e2ce5105d7a09809d1168466918c Mon Sep 17 00:00:00 2001
From: opencode-probe <probe@tmp>
Date: Tue, 15 Sep 2026 17:27:14 -0400
Subject: [PATCH] Dispatch runs: clone via vault GH_READ_TOKEN (no github
 context on dispatch)

The github context exists on github/cli triggers only. Dispatch path
failed all runs at clone. Secret value to be set once by maintainer.
---
 .rwx/dispatch.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.rwx/dispatch.yml b/.rwx/dispatch.yml
index 4c446c0..13ed4ec 100644
--- a/.rwx/dispatch.yml
+++ b/.rwx/dispatch.yml
@@ -27,7 +27,10 @@ tasks:
     with:
       repository: https://github.com/wave-av/cli.git
       ref: ${{ init.commit-sha }}
-      github-token: ${{ github.token }}
+      # NOTE: the `github` context does not exist on dispatch-triggered runs
+      # (only on github/cli triggers). Use a vault-backed read-only PAT instead.
+      # One-time setup: rwx vaults secrets set GH_READ_TOKEN=<classic-PAT-repo-read> --vault default
+      github-token: ${{ secrets.GH_READ_TOKEN }}
 
   - key: node
     call: nodejs/install 1.2.0