How to fix Error: Input required and not supplied: token in Git

- name: Checkout repository
  uses: actions/checkout@v4
  with:
    token: ${{ secrets.GITHUB_TOKEN }}

- name: Comment on PR
  uses: thollander/actions-comment-pull-request@v2
  with:
    message: "Build successful!"
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

# Some actions use 'github-token'
- uses: some-action/example@v1
  with:
    github-token: ${{ secrets.GITHUB_TOKEN }}

# Others use 'repo-token'
- uses: another-action/example@v1
  with:
    repo-token: ${{ secrets.GITHUB_TOKEN }}

# In the action's action.yml file:
inputs:
  token:
    description: 'GitHub token for authentication'
    required: true  # <-- This means you MUST provide it
    default: ''

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      issues: write
    steps:
      - uses: actions/checkout@v4
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

name: CI
on: [push, pull_request]

permissions:
  contents: read
  pull-requests: write

jobs:
  build:
    runs-on: ubuntu-latest
    # ...

on:
  pull_request_target:
    types: [opened, synchronize]

jobs:
  comment:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with:
          # IMPORTANT: Check out PR head for pull_request_target
          ref: ${{ github.event.pull_request.head.sha }}
          token: ${{ secrets.GITHUB_TOKEN }}

# Workflow 1: Build (runs on PR, limited permissions)
name: Build
on: pull_request
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm test
      - uses: actions/upload-artifact@v4
        with:
          name: results
          path: results.json

# Workflow 2: Comment (runs after build, full permissions)
name: Comment
on:
  workflow_run:
    workflows: ["Build"]
    types: [completed]
jobs:
  comment:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    # Use workflow_run context to comment with full permissions

- name: Checkout with PAT
  uses: actions/checkout@v4
  with:
    token: ${{ secrets.PAT_TOKEN }}

- name: Create PR
  uses: peter-evans/create-pull-request@v5
  with:
    token: ${{ secrets.PAT_TOKEN }}
    title: "Automated PR"
    branch: auto-update

- name: Debug info
  run: |
    echo "Event: ${{ github.event_name }}"
    echo "Actor: ${{ github.actor }}"
    echo "Repository: ${{ github.repository }}"
    echo "Token permissions available:"
    echo "${{ toJson(github.token) }}" | head -c 20
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Verify token exists
  run: |
    if [ -z "$TOKEN" ]; then
      echo "ERROR: Token is empty!"
      exit 1
    else
      echo "Token is set (length: ${#TOKEN})"
    fi
  env:
    TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Test API access
  run: |
    curl -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
      -H "Accept: application/vnd.github.v3+json" \
      https://api.github.com/repos/${{ github.repository }}

- name: Check token permissions
  uses: actions/github-script@v7
  with:
    github-token: ${{ secrets.GITHUB_TOKEN }}
    script: |
      const { data } = await github.rest.apps.getRepoInstallation({
        owner: context.repo.owner,
        repo: context.repo.repo,
      });
      console.log('Permissions:', data.permissions);

# Good: Pin to major version (gets security updates)
- uses: actions/checkout@v4

# Better for stability: Pin to specific version
- uses: actions/[email protected]

# Most stable: Pin to commit SHA
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11

# v3 - token was optional for public repos
- uses: actions/checkout@v3

# v4 - may require explicit token in some cases
- uses: actions/checkout@v4
  with:
    token: ${{ secrets.GITHUB_TOKEN }}

# Use dependabot or renovate to track action updates
# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"