[Laurianti]

Since #1443 the "Update API references" job fails at actions/checkout: it checks out with secrets.REPO_TOKEN, GitHub rejects that token, and git reports could not read Username for 'https://github.com'.

The job now uses the default GITHUB_TOKEN, with contents: write, and pushes the regenerated docs to master, as before. master may refuse that push: all but one of its last 400 commits came through a pull request. When it does, the job falls back to a pull request:

• it pushes the docs to an update-api-references branch, which updates the pull request from that branch if one is already open;
• otherwise it opens one into master;
• if GitHub Actions is not allowed to create pull requests in this repository, the run still succeeds and leaves a notice with the link to open the pull request by hand.

Before	Now
actions/checkout fails: could not read Username	the docs land on master, or on update-api-references with a pull request into master

Checked on GitHub runners, with the default workflow permissions set to read only:

• with an invalid REPO_TOKEN, the checkout fails with the same error;
• on an unprotected branch, github-actions[bot] pushes the docs straight to it;
• on a branch that requires a pull request, the push is refused (GH006: Protected branch update failed) and the job pushes update-api-references; with "Allow GitHub Actions to create and approve pull requests" off it leaves the notice and the link, with it on it opens the pull request;
• a later change updates the open pull request instead of opening another, two runs close together leave only the newer one, and merging the docs does not start the job again.

REPO_TOKEN is no longer used by any workflow after this change.

[Copilot]

Copilot review overview

🟢 Approval recommended

The workflow handles direct pushes, protected branches, existing pull requests, and disabled automatic PR creation coherently.

Review effort: Balanced
Findings: None

What changed in this PR

Updates API-reference automation to use GITHUB_TOKEN and gracefully handle protected branches.

Changes:

• Grants required repository and pull-request permissions.
• Pushes directly when allowed; otherwise updates a dedicated branch and opens a pull request.
• Emits a manual pull-request link when automatic creation is disabled.

File	Description
.github/​workflows/​update_api_references.yml	Adds token permissions and protected-branch fallback logic.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[martindevans]

Looks good, thanks for working on this ❤️

[Laurianti]

Thanks! It hasn't run on master yet, since it only starts on changes under LLama/. I'll check the first run after the next merge there and follow up if it needs anything.