fix: use GITHUB_TOKEN for PR checkouts, reserve COMMAND_BOT_PAT for push only

[Copilot]

secrets.COMMAND_BOT_PAT was used unconditionally in the checkout step, causing the workflow to fail on fork PRs where that secret is unavailable. The PAT is only needed for the gh-pages push, not for the build/verify steps.

Changes

• .github/workflows/generate-top-index.yml: Conditionally select the checkout token based on event type:

# Before
token: ${{ secrets.COMMAND_BOT_PAT }}

# After
token: ${{ github.event_name == 'push' && secrets.COMMAND_BOT_PAT || github.token }}

☑️ Resolves

🖼️ Screenshots

Original prompt

Problem

The workflow .github/workflows/generate-top-index.yml currently uses secrets.COMMAND_BOT_PAT unconditionally in the checkout step, which prevents it from working on forks since they don't have access to this secret.

Solution

Modify the workflow to:

1. Use secrets.COMMAND_BOT_PAT only for push events (when deploying to gh-pages)
2. Use the default GITHUB_TOKEN for pull request events (when just testing the build)

Changes needed

In .github/workflows/generate-top-index.yml:

Line 33 currently has:

token: ${{ secrets.COMMAND_BOT_PAT }}

Change it to:

token: ${{ github.event_name == 'push' && secrets.COMMAND_BOT_PAT || github.token }}

This conditional expression will:

• Use secrets.COMMAND_BOT_PAT when the event is a push (needed for gh-pages deployment)
• Use github.token (the default GITHUB_TOKEN) for pull requests (works on forks)

The PAT is only actually needed for the push to gh-pages branch anyway (lines 64-75), so pull requests don't require it.

The following is the prior conversation context from the user's chat exploration (may be truncated):

User: Please ensure it wtill works on forks by NOT using secrets.COMMAND_BOT_PAT if it's a PR. Only use it on push

Assistant: I can see the issue. The workflow currently uses secrets.COMMAND_BOT_PAT unconditionally in the checkout step (line 33), which will fail on forks since they won't have access to this secret. The solution is to conditionally use the PAT only for push events, and use the default GITHUB_TOKEN for pull requests.

Assistant: I'm waiting for your approval to create a pull request that will make the workflow work on forks by using the PAT only for push events and the default GitHub token for pull requests.

This pull request was created from Copilot chat.

[skjnldsv]

Fork test #14361
https://github.com/nextcloud/documentation/actions/runs/24517180895/job/71664427898?pr=14361

[skjnldsv]

Failure unrelated, merging