From eef5d654f8acacae3d5cd4e6903f3926aa961451 Mon Sep 17 00:00:00 2001
From: ChristophShyper <45788587+ChristophShyper@users.noreply.github.com>
Date: Mon, 21 Sep 2026 22:16:00 +0200
Subject: [PATCH] fix(cron): use push token for dependency branches

Use the organization PUSH_TOKEN when committing weekly dependency updates so changes to GitHub Actions workflow files can be pushed. Keep pull request creation on the default token and expose the elevated secret through the reusable workflow contract.
---
 .github/workflows/reusable-cron-dependency-update.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/reusable-cron-dependency-update.yml b/.github/workflows/reusable-cron-dependency-update.yml
index 011debf..14c71fc 100644
--- a/.github/workflows/reusable-cron-dependency-update.yml
+++ b/.github/workflows/reusable-cron-dependency-update.yml
@@ -30,6 +30,8 @@ on:
     secrets:
       DOCKER_TOKEN:
         required: false
+      PUSH_TOKEN:
+        required: true
       SSH_SIGNING_KEY:
         required: false
 
@@ -271,7 +273,7 @@ jobs:
         if: steps.changes.outputs.has_changes == 'true'
         uses: devops-infra/action-commit-push@v1
         with:
-          github_token: ${{ github.token }}
+          github_token: ${{ secrets.PUSH_TOKEN }}
           target_branch: chore/weekly-health-${{ github.run_id }}
           commit_message: "chore(deps): weekly dependency and health updates"
           signing_mode: ssh