fix: use PAT for label-rebase-prs to trigger rebase workflow (#2596)

.github/workflows/label-rebase-prs.yml

@@ -8,16 +8,14 @@ concurrency:
   group: label-rebase-prs
   cancel-in-progress: true
 
-permissions:
-  pull-requests: write
-  issues: write
-
 jobs:
   label-conflicting-prs:
+    environment: ai-bots
     runs-on: ubuntu-latest
     steps:
       - uses: actions/github-script@v7
         with:
+          github-token: ${{ secrets.PR_RW_GITHUB_TOKEN }}
           script: |
             const allowedAuthors = ['wwwillchen', 'wwwillchen-bot'];
 

rules/git-workflow.md

@@ -25,6 +25,10 @@ When running GitHub Actions with `pull_request_target` on cross-repo PRs (from f
 - The `GITHUB_TOKEN` can push to the fork if the PR author enabled "Allow edits from maintainers"
 - **`claude-code-action` overwrites origin's fetch URL** to point to the base repo (using `GITHUB_REPOSITORY`). Any workflow that needs to push to the fork must set `pushurl` separately via `git remote set-url --push origin <fork-url>`, because git uses `pushurl` over `url` when both are configured. See `pr-review-responder.yml` and `claude-rebase.yml` for examples.
 
+## GITHUB_TOKEN and workflow chaining
+
+Actions performed using the default `GITHUB_TOKEN` (including labels added by `github-actions[bot]` via `actions/github-script`) do **not** trigger `pull_request_target` or other workflow events. This is a GitHub limitation to prevent infinite loops. If one workflow adds a label that should trigger another workflow (e.g., `label-rebase-prs.yml` adds `cc:rebase` to trigger `claude-rebase.yml`), the label-adding step must use a **PAT** or **GitHub App token** (e.g., `PR_RW_GITHUB_TOKEN`) instead of `GITHUB_TOKEN`.
+
 ## Adding labels to PRs
 
 `gh pr edit --add-label` fails with a GraphQL "Projects (classic)" deprecation error on repos that had classic projects. Use the REST API instead: