@kungfu-tech/buildchain 2.4.10 → 2.4.11-alpha.1

package/actions/report-buildchain-issue/README.md

@@ -61,7 +61,7 @@ steps:
   - uses: kungfu-systems/buildchain/actions/report-buildchain-issue@v2
     if: failure()
     with:
-      token: ${{ github.token }}
+      token: ${{ secrets.BUILDCHAIN_ISSUE_TOKEN || secrets.BUILDCHAIN_PROMOTION_TOKEN || github.token }}
       report-kind: workflow-friction
       target-repository: ${{ github.repository }}
       repository: ${{ github.repository }}

package/docs/reusable-build-surface.md

@@ -390,6 +390,8 @@ set is missing or ambiguous.
 jobs:
   promote:
     uses: kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v2
+    secrets:
+      buildchain-issue-token: ${{ secrets.BUILDCHAIN_ISSUE_TOKEN }}
     with:
       channel: alpha
       target-ref: alpha/v22/v22.22
@@ -410,6 +412,13 @@ jobs:
       release-passport-product-name: Libnode
 ```
 
+`buildchain-issue-token` is optional but recommended for cross-repository
+consumers. It should be a GitHub App installation token or other scoped token
+with `issues: write` on `kungfu-systems/buildchain`. If omitted, the wrapper
+falls back to `BUILDCHAIN_PROMOTION_TOKEN` and then the consumer workflow's
+`github.token`; the last fallback can only report issues when it has write
+access to the target Buildchain repository.
+
 `publish-required-artifacts-json` can still be passed explicitly for custom
 publish targets. For the default `publish-artifact-kind: npm` path, consumers do
 not download artifacts or run repository scripts to build publish evidence. The

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.4.10",
+  "version": "2.4.11-alpha.1",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",