fix(ci): fallback to GITHUB_TOKEN when Claude app secrets missing

Auto-triage works without cross-repo secret copy. Sync workflow documents
manual fallback when SECRETS_ADMIN_PAT is unavailable.

Co-authored-by: Cursor <[email protected]>

.github/workflows/claude.yml

@@ -39,16 +39,26 @@ jobs:
     steps:
       - name: Generate GitHub App Token
         id: app-token
+        continue-on-error: true
         uses: actions/create-github-app-token@v1
         with:
           app-id: ${{ secrets.CLAUDE_APP_ID }}
           private-key: ${{ secrets.CLAUDE_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
 
+      - name: Resolve GitHub token
+        id: github-token
+        run: |
+          if [ -n "${{ steps.app-token.outputs.token }}" ]; then
+            echo "token=${{ steps.app-token.outputs.token }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "token=${{ secrets.GITHUB_TOKEN }}" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Triage and acknowledge issue
         uses: actions/github-script@v7
         with:
-          github-token: ${{ steps.app-token.outputs.token }}
+          github-token: ${{ steps.github-token.outputs.token }}
           script: |
             const issue = context.payload.issue;
             const title = (issue.title || '').toLowerCase();
@@ -152,16 +162,27 @@ jobs:
     steps:
       - name: Generate GitHub App Token
         id: app-token
+        continue-on-error: true
         uses: actions/create-github-app-token@v1
         with:
           app-id: ${{ secrets.CLAUDE_APP_ID }}
           private-key: ${{ secrets.CLAUDE_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
 
+      - name: Resolve GitHub token
+        id: github-token
+        run: |
+          if [ -n "${{ steps.app-token.outputs.token }}" ]; then
+            echo "token=${{ steps.app-token.outputs.token }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "token=${{ secrets.GITHUB_TOKEN }}" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Check for Fork PR
         id: check_fork
         uses: actions/github-script@v7
         with:
+          github-token: ${{ steps.github-token.outputs.token }}
           script: |
             const isPR = context.eventName === 'pull_request' || (context.payload.issue && context.payload.issue.pull_request);
             if (isPR) {
@@ -188,7 +209,7 @@ jobs:
         with:
           persist-credentials: false
           fetch-depth: 0
-          token: ${{ steps.app-token.outputs.token }}
+          token: ${{ steps.github-token.outputs.token }}
 
       - name: Fetch PR branch and Setup Remote
         if: github.event.issue.pull_request
@@ -204,11 +225,11 @@ jobs:
       - name: Run Claude Code Action
         uses: anthropics/claude-code-action@beta
         env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          GH_TOKEN: ${{ steps.github-token.outputs.token }}
         with:
           allowed_bots: 'praisonai-triage-agent[bot]'
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          github_token: ${{ steps.app-token.outputs.token }}
+          github_token: ${{ steps.github-token.outputs.token }}
           trigger_phrase: "@claude"
           label_trigger: "claude"
           timeout_minutes: "30"

.github/workflows/sync-secrets-from-praisonai.yml

@@ -1,9 +1,13 @@
 name: Sync Claude Secrets from PraisonAI
 
-# Secrets cannot be read back from GitHub. This workflow triggers the
-# canonical sync job in MervinPraison/PraisonAI, which copies:
+# GitHub does not allow reading secret values back via API.
+# This workflow triggers the sync job in MervinPraison/PraisonAI, which copies:
 #   CLAUDE_APP_ID, CLAUDE_APP_PRIVATE_KEY, CLAUDE_CODE_OAUTH_TOKEN, GH_TOKEN
-# into this repository.
+#
+# Requires SECRETS_ADMIN_PAT in PraisonAI (repo Settings → Secrets).
+# If sync fails, copy secrets manually:
+#   PraisonAI → Settings → Secrets → Actions
+#   PraisonAIUI → Settings → Secrets → Actions (same names)
 
 on:
   workflow_dispatch:
@@ -22,5 +26,7 @@ jobs:
           gh workflow run sync-secrets-to-aiui.yml \
             --repo MervinPraison/PraisonAI \
             --ref main
-          echo "Triggered MervinPraison/PraisonAI → sync-secrets-to-aiui.yml"
-          echo "Check: https://github.com/MervinPraison/PraisonAI/actions/workflows/sync-secrets-to-aiui.yml"
+          echo "Triggered: https://github.com/MervinPraison/PraisonAI/actions/workflows/sync-secrets-to-aiui.yml"
+          echo ""
+          echo "If sync fails (401/403), refresh SECRETS_ADMIN_PAT in PraisonAI,"
+          echo "or copy CLAUDE_APP_ID + CLAUDE_APP_PRIVATE_KEY + GH_TOKEN manually."