From ee90ae828e25d5780f23b28e5e3738c618edb533 Mon Sep 17 00:00:00 2001
From: Andrew White <andrewh@cdw.com>
Date: Fri, 31 Jul 2026 07:41:23 -0500
Subject: [PATCH] fix: lockfile workflow cannot push bump branch without PAT

- Add token: ${{ secrets.PAT }} to the update-lockfile checkout step so the
  subsequent push of the bump branch is authenticated.
- Add pytest-discoverable regression test that verifies the PAT is present.

Signed-off-by: Andrew White <andrewh@cdw.com>
---
 .github/workflows/_update_dependencies.yml    |  1 +
 .../test_update_deps_checkout_pat.py          | 24 +++++++++++++++++++
 2 files changed, 25 insertions(+)
 create mode 100644 unit_tests/github_actions/test_update_deps_checkout_pat.py

diff --git a/.github/workflows/_update_dependencies.yml b/.github/workflows/_update_dependencies.yml
index d55bdfb53..23302b020 100644
--- a/.github/workflows/_update_dependencies.yml
+++ b/.github/workflows/_update_dependencies.yml
@@ -56,6 +56,7 @@ jobs:
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           ref: ${{ env.TARGET_BRANCH }}
+          token: ${{ secrets.PAT }}
 
       - name: Build container
         env:
diff --git a/unit_tests/github_actions/test_update_deps_checkout_pat.py b/unit_tests/github_actions/test_update_deps_checkout_pat.py
new file mode 100644
index 000000000..55c3b6c20
--- /dev/null
+++ b/unit_tests/github_actions/test_update_deps_checkout_pat.py
@@ -0,0 +1,24 @@
+#!/usr/bin/env python3
+"""Regression test: update-lockfile checkout must use PAT to push branch."""
+
+import re
+
+
+def test_update_deps_checkout_pat():
+    with open(".github/workflows/_update_dependencies.yml") as f:
+        content = f.read()
+
+    # Isolate the update-lockfile job (it precedes create-pr)
+    update_job = content.split("  create-pr:")[0]
+
+    match = re.search(
+        r"- name: Checkout repo\s+uses: actions/checkout@[^\n]+\s+with:\s+ref: \$\{\{ env\.TARGET_BRANCH \}\}(?:\s+token: \$\{\{ secrets\.PAT \}\})?",
+        update_job,
+        re.DOTALL,
+    )
+    assert match is not None, "Could not locate update-lockfile checkout step"
+
+    block = match.group(0)
+    assert "token: ${{ secrets.PAT }}" in block, (
+        "BUG: update-lockfile checkout must authenticate with PAT to push the bump branch"
+    )