From 6211ec592c31e1e8528fe13c122b04db7b344868 Mon Sep 17 00:00:00 2001
From: Aditya Pujara <59631311+a0x1ab@users.noreply.github.com>
Date: Wed, 1 Jul 2026 17:25:56 +0930
Subject: [PATCH] live-test-powershell: read public PR head with github.token
 (avoid classic-PAT policy)

---
 .github/workflows/live-test-powershell.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/live-test-powershell.yml b/.github/workflows/live-test-powershell.yml
index ab5c4ff..669933a 100644
--- a/.github/workflows/live-test-powershell.yml
+++ b/.github/workflows/live-test-powershell.yml
@@ -83,7 +83,11 @@ jobs:
       - name: Resolve PR head SHA
         id: pr
         env:
-          GH_TOKEN: ${{ steps.kv.outputs.pat }}
+          # Public PR read — use the ambient workflow token (a short-lived
+          # installation token). The bot PAT from Key Vault is only needed for
+          # the cross-repo comment WRITE below, and is subject to the org's
+          # classic-PAT lifetime policy, so we avoid it for reads.
+          GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
           owner="${PR_REPO%/*}"