fix: lockfile workflow cannot push bump branch without PAT

[andrewwhitecdw]

This PR addresses the following issue in .github/workflows/_update_dependencies.yml: lockfile workflow cannot push bump branch without PAT.

Changes

• .github/workflows/_update_dependencies.yml: lockfile workflow cannot push bump branch without PAT.

Details

--- a/.github/workflows/_update_dependencies.yml
+++ b/.github/workflows/_update_dependencies.yml
@@ -1,4 +1,5 @@
-      - name: Checkout repo
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
-        with:
-          ref: ${{ env.TARGET_BRANCH }}
+      - name: Checkout repo
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          ref: ${{ env.TARGET_BRANCH }}
+          token: ${{ secrets.PAT }}

Tests

• tests/unit_tests/github_actions/test_update_deps_checkout_pat.py

--- /dev/null
+++ tests/unit_tests/github_actions/test_update_deps_checkout_pat.py
@@ -0,0 +1,31 @@
+#!/usr/bin/env python3
+"""Regression test: update-lockfile checkout must use PAT to push branch."""
+
+import re
+import sys
+
+
+def main():
+    with open(".github/workflows/_update_dependencies.yml") as f:
+        content = f.read()
+
+    # Isolate the update-lockfile job (it precedes create-pr)
+    update_job = content.split("  create-pr:")[0]
+
+    match = re.search(
+        r"- name: Checkout repo\s+uses: actions/checkout@[^\n]+\s+with:\s+ref: \$\{\{ env\.TARGET_BRANCH \}\}(?:\s+token: \$\{\{ secrets\.PAT \}\})?",
+        update_job,
+        re.DOTALL,
+    )
+    if not match:
+        print("Could not locate update-lockfile checkout step")
+        sys.exit(1)
+
+    block = match.group(0)
+    if "token: ${{ secrets.PAT }}" not in block:
+        print("BUG: update-lockfile checkout must authenticate with PAT to push the bump branch")
+        sys.exit(1)
+
+    print("OK")
+
+
+if __name__ == "__main__":
+    main()

Contributor guidelines

Per this repo's CONTRIBUTING.md:

• All commits are signed off (Signed-off-by trailer, DCO).

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[andrewwhitecdw]

Repair after adversarial audit failure:

• Removed the unrelated mass workflow/action pinning changes that were added by the previous fixup commit. The diff now contains only the intended PAT token fix in .github/workflows/_update_dependencies.yml.
• Converted the regression test from a script-style main() function (which was never invoked) to a pytest-discoverable test_update_deps_checkout_pat() function so it actually runs in CI.

Ready for re-audit.