ci: fall back to GITHUB_TOKEN when REPO_ACCESS_TOKEN unavailable

actions/checkout@v6 (bumped in this PR) errors on empty token input,
whereas v4 silently tolerated it. Dependabot PRs run without access to
Actions secrets, so secrets.REPO_ACCESS_TOKEN resolves to empty string
and every sibling-repo checkout fails with:

    ##[error]Input required and not supplied: token

The InstaNode-dev/{proto,common,api,infra} sibling repos are all public,
so GITHUB_TOKEN (scoped to the running repo, read-only on org public
siblings) is a valid fallback. Regular PRs continue to use the PAT.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: claude

.github/workflows/ci.yml

@@ -106,7 +106,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           repository: ${{ vars.PROTO_REPO || format('{0}/proto', github.repository_owner) }}
-          token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
           path: _proto_ci
 
       - name: Place ../proto for Go replace directive
@@ -116,7 +116,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           repository: ${{ vars.COMMON_REPO || format('{0}/common', github.repository_owner) }}
-          token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
           path: _common_ci
 
       - name: Place ../common for Go replace directive
@@ -191,7 +191,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           repository: ${{ vars.PROTO_REPO || format('{0}/proto', github.repository_owner) }}
-          token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
           path: _proto_ci
 
       - run: mv _proto_ci ../proto
@@ -200,7 +200,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           repository: ${{ vars.COMMON_REPO || format('{0}/common', github.repository_owner) }}
-          token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
           path: _common_ci
       - run: mv _common_ci ../common
 

.github/workflows/coverage.yml

@@ -104,14 +104,14 @@ jobs:
         uses: actions/checkout@v6
         with:
           repository: ${{ vars.PROTO_REPO || format('{0}/proto', github.repository_owner) }}
-          token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
           path: proto
 
       - name: Checkout common sibling (for go.mod replace ../common)
         uses: actions/checkout@v6
         with:
           repository: ${{ vars.COMMON_REPO || format('{0}/common', github.repository_owner) }}
-          token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
           path: common
 
       - uses: actions/setup-go@v6

.github/workflows/deploy.yml

@@ -110,14 +110,14 @@ jobs:
           # is a fine-grained PAT with read access to
           # InstaNode-dev/{common,proto}. Set via
           # `gh secret set REPO_ACCESS_TOKEN --repo InstaNode-dev/<name>`.
-          token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
           path: common
 
       - name: Checkout proto sibling into ./proto
         uses: actions/checkout@v6
         with:
           repository: ${{ vars.PROTO_REPO || format('{0}/proto', github.repository_owner) }}
-          token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
           path: proto
 
       - name: Compute build metadata

.github/workflows/integration-backup.yml

@@ -58,7 +58,7 @@ jobs:
         with:
           repository: ${{ github.repository_owner }}/infra
           path: infra
-          token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
       - name: Install kubectl
         uses: azure/setup-kubectl@v5
       - name: Set up Go