[chaliy]

What changed

The Coreutils Args Drift workflow's open-pr job now uses two tokens instead of
one. The drift branch is pushed with github.token (that only needs
contents: write), and the pull request is opened with a PAT read from
Doppler's GITHUB_TOKEN, gated on DOPPLER_TOKEN being configured and masked
before it crosses a step boundary — the pattern ci.yml already uses for
privileged CI credentials.

If no PAT is available the PR step fails with a message naming the branch the
drift was pushed to, rather than skipping the PR.

Why

The weekly run regenerated the drift, force-pushed it to
chore/coreutils-args-drift, then died on gh pr create:

pull request create failed: GraphQL: GitHub Actions is not permitted to
create or approve pull requests (createPullRequest)

(run 39234801977).
Everything before that was green — regeneration, build, cat/tac spec tests and
the differential harness all passed — so the run went red at the last step with
no PR to show for it, and the drift stayed invisible. That is the same
silent-absorption failure the open-PR-only lookup was added to prevent (#2161),
arriving through a different door.

The job token cannot open a PR while "Allow GitHub Actions to create and approve
pull requests" is off. Leaving that setting off is the right call — the same
switch also lets Actions approve PRs, which would weaken review gating — so
the fix gives the PR step its own credential instead of widening what the job
token may do.

Failing loudly on a missing PAT is deliberate. The drift is already pushed by
the time that step runs, so a green run with no PR would recreate exactly the
invisible-drift mode; a red run with the branch name in the error is
recoverable by hand.

The pending drift this run produced is in #2759.

Before / After

Before — Open pull request if drifted fails on every drifted run:

[chore/coreutils-args-drift 439fd13] chore(builtins): sync uutils/coreutils ...
 20 files changed, 22 insertions(+), 20 deletions(-)
 + d65b0d0...439fd13 chore/coreutils-args-drift -> chore/coreutils-args-drift (forced update)
pull request create failed: GraphQL: GitHub Actions is not permitted to create or approve pull requests (createPullRequest)
##[error]Process completed with exit code 1.

After — the push and the PR run on separate tokens, and the no-PAT path is a
named error instead of a GraphQL failure that reads like a bug in the drift
tooling. Both halves are pinned by tests that execute the workflow's own run
scripts with stubbed gh/git:

$ python3 -m unittest discover -s scripts/tests -p 'test_*.py'
Ran 179 tests in 7.673s
OK

$ python3 -m unittest scripts.tests.test_coreutils_drift_pr -v
test_missing_pat_fails_loudly_without_touching_the_pr ... ok
test_open_state_is_scoped_in_the_lookup ... ok
test_opens_a_new_pr_when_only_a_closed_one_matches ... ok
test_push_and_pr_use_separate_tokens ... ok
test_updates_the_existing_pr_when_one_is_open ... ok
Ran 5 tests in 0.132s
OK

Also checked: every run block in the workflow passes bash -n (this file has
been broken by shell/YAML slips before), the YAML parses, just check-okf
reports conformant, and just check-doc-links is clean.

The secret boundary this workflow documents is preserved, and verified
mechanically: the regenerate job — the only one that builds or executes
third-party uutils code — has no Doppler step and no secret access. The PAT
lives only in open-pr, which never checks out, builds or runs uutils; its two
remaining mentions of "uutils" are the commit message and the PR body text. The
workflow is also schedule + workflow_dispatch only, so no pull-request
trigger can reach the secret.

Risk

• Low
• The workflow is weekly and workflow_dispatch, and the change is confined to
  its open-pr job; no library or runtime code is touched.
• The one dependency worth calling out: this needs Doppler to hold a
  GITHUB_TOKEN with pull-requests: write on this repository. I could not
  verify that from the sandbox — reading the secret store is blocked there — so
  if the key is absent or under-scoped, the next drifted run will say so
  explicitly in its error rather than failing obscurely. Worth a
  workflow_dispatch run to confirm end to end.

Checklist

• Tests added or updated — existing tests retargeted to the split steps,
  plus two new ones: the fail-loud guard and the token split
• Backward compatibility considered — CI-only change; no public surface

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	e8c0474	Commit Preview URL Branch Preview URL	Oct 20 2026, 09:43 AM