Fixed: lock/unlock missing admin token (#165)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Pete Sramek <petr.sramek@dropoutcoder.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Author: 6 people

.github/actions/github/branch-protection/lock/action.yml

@@ -5,14 +5,17 @@ inputs:
   branch:
     description: 'Branch name to lock.'
     required: true
+  token:
+    description: 'GitHub token with administration:write (repo admin) permission. Use a PAT; GITHUB_TOKEN cannot call the branch protection API.'
+    required: true
 
 runs:
   using: composite
   steps:
     - name: 'Lock branch ${{ inputs.branch }}'
       shell: bash
       env:
-        GH_TOKEN: ${{ github.token }}
+        GH_TOKEN: ${{ inputs.token }}
       run: |
         if ! gh api --method PUT /repos/${{ github.repository }}/branches/${{ inputs.branch }}/protection \
           --input - << 'EOF'

.github/actions/github/branch-protection/unlock/action.yml

@@ -5,14 +5,17 @@ inputs:
   branch:
     description: 'Branch name to unlock.'
     required: true
+  token:
+    description: 'GitHub token with administration:write (repo admin) permission. Use a PAT; GITHUB_TOKEN cannot call the branch protection API.'
+    required: true
 
 runs:
   using: composite
   steps:
     - name: 'Unlock branch ${{ inputs.branch }}'
       shell: bash
       env:
-        GH_TOKEN: ${{ github.token }}
+        GH_TOKEN: ${{ inputs.token }}
       run: |
         gh api --method DELETE /repos/${{ github.repository }}/branches/${{ inputs.branch }}/protection || true
         echo "🔓 Branch protection removed from '${{ inputs.branch }}'." >> $GITHUB_STEP_SUMMARY

.github/workflows/promote-branch.yml

@@ -216,6 +216,7 @@ jobs:
         uses: './.github/actions/github/branch-protection/lock'
         with:
           branch: ${{ needs.workflow-variables.outputs.target-branch }}
+          token: ${{ secrets.GH_ADMIN_TOKEN }}
       - name: 'Create PR: "Promote ${{ env.current-branch }} to ${{ env.target-branch }}"'
         if: ${{ needs.workflow-variables.outputs.pull-request-exists == 'false' }}
         env:

.github/workflows/release.yml

@@ -357,6 +357,7 @@ jobs:
         uses: './.github/actions/github/branch-protection/lock'
         with:
           branch: ${{ steps.resolve-support-branch.outputs.support-branch }}
+          token: ${{ secrets.GH_ADMIN_TOKEN }}
 
       - name: 'Write support branch summary'
         run: |