From 314707ca268fa00ca35c2b0e66a3f8979caca85e Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 2 Nov 2026 07:31:21 +0000
Subject: [PATCH] ci: separate tracker read and write credentials

---
 templates/track-estate-audit.yml | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/templates/track-estate-audit.yml b/templates/track-estate-audit.yml
index 09e7464..415eee9 100644
--- a/templates/track-estate-audit.yml
+++ b/templates/track-estate-audit.yml
@@ -43,10 +43,8 @@ jobs:
     # (hypatia WF013 / WH006). The whole job is a clone, a sed and a PR.
     timeout-minutes: 20
     permissions:
-      contents: write
-      pull-requests: write
+      contents: read
     env:
-      GH_TOKEN: ${{ secrets.AUTOMATION_TOKEN || secrets.GITHUB_TOKEN }}
       BRANCH: ci/track-estate-audit
       BOT_EMAIL: 41898583+github-actions[bot]@users.noreply.github.com
     steps:
@@ -60,6 +58,9 @@ jobs:
             api.github.com:443
             github.com:443
       - name: Move every cicd-suite pin to HEAD and open a PR
+        env:
+          GH_TOKEN: ${{ github.token }}
+          WRITE_TOKEN: ${{ secrets.AUTOMATION_TOKEN }}
         run: |
           set -euo pipefail
           gh auth setup-git
@@ -99,6 +100,12 @@ jobs:
             exit 0
           fi
 
+          if [ -z "$WRITE_TOKEN" ]; then
+            echo "::error::Stale cicd-suite pins detected. AUTOMATION_TOKEN is required to propose their update."
+            exit 1
+          fi
+          export GH_TOKEN="$WRITE_TOKEN"
+
           # The bot branch is rebuilt from the default branch each run, which
           # would discard anything else on it. If someone has pushed to it
           # (say, a fix the newer gate needed), leave it for review.