Update GITHUB_PAT secret in lint workflow

[d-morrison]

This pull request makes a small change to the GitHub Actions workflow configuration. The environment variable GITHUB_PAT is now set to use the GITHUB_PAT secret instead of the default GITHUB_TOKEN secret.

• .github/workflows/lint-changed-files.yaml: Updated the GITHUB_PAT environment variable to use secrets.GITHUB_PAT for improved secret management.

[claude]

Claude finished @d-morrison's task in 46s —— View job

---

Code Review

• Gather context and read changed files
• Analyze the change

---

One-line change: .github/workflows/lint-changed-files.yaml line 14 — secrets.GITHUB_TOKEN → secrets.GITHUB_PAT.

Assessment

The change itself is syntactically correct, but it introduces a reliability concern worth flagging before merging.

Potential issue — workflow silently breaks if the secret is missing

secrets.GITHUB_TOKEN is automatically injected by GitHub Actions on every run. secrets.GITHUB_PAT is a manually created Personal Access Token (PAT) that must be explicitly added to the repository or organization secrets. If GITHUB_PAT is not configured:

• GitHub Actions will resolve it to an empty string (no error at parse time).
• The gh::gh() call on line 40 will receive no token, causing a 401/403 from the GitHub API, and the workflow will fail for all PRs.

The existing permissions: read-all should already be sufficient

The workflow already declares permissions: read-all (line 8), which grants GITHUB_TOKEN read access to repository contents, pull requests, and the API endpoints used here. The gh::gh() call only reads PR file lists — no write permissions are needed. Unless there was a documented case where GITHUB_TOKEN was failing for this specific workflow, switching to a PAT adds maintenance overhead (PATs can expire or be revoked) without a clear benefit.

Questions before approving:

1. Was there a specific failure with secrets.GITHUB_TOKEN that motivated this change? If so, documenting it in the PR description would help future maintainers.
2. Has secrets.GITHUB_PAT been added to the repository secrets? If not, this will break linting for all PRs immediately after merge.

If a PAT is genuinely needed (e.g., for rate-limiting reasons or org-level access), consider using a fine-grained PAT scoped to only contents: read and pull_requests: read, and document its purpose and expiry in the repo's secrets inventory.

---

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.