From 7696bf97a6a00171c311ea82c948dcfeebf7e638 Mon Sep 17 00:00:00 2001
From: simonrosenberg <157206163+simonrosenberg@users.noreply.github.com>
Date: Thu, 23 Apr 2026 16:30:27 -0300
Subject: [PATCH 1/2] chore: use OPENHANDS_BOT_GITHUB_PAT_PUBLIC in
 sync-docs-code-blocks.yml

---
 .github/workflows/sync-docs-code-blocks.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/sync-docs-code-blocks.yml b/.github/workflows/sync-docs-code-blocks.yml
index 354d90fc..204a5a09 100644
--- a/.github/workflows/sync-docs-code-blocks.yml
+++ b/.github/workflows/sync-docs-code-blocks.yml
@@ -103,21 +103,21 @@ jobs:
             - [x] I have read and reviewed the documentation changes to the best of my ability.
             - [x] If the change is significant, I have run the documentation site locally and confirmed it renders as expected.
 
-      # Auto-approve using PAT_TOKEN (all-hands-bot). PR is created by
+      # Auto-approve using OPENHANDS_BOT_GITHUB_PAT_PUBLIC (all-hands-bot). PR is created by
       # github-actions[bot], so a different identity (all-hands-bot) can approve it.
       - name: Auto-approve PR
-        if: steps.cpr.outputs.pull-request-url && secrets.PAT_TOKEN != ''
+        if: steps.cpr.outputs.pull-request-url && secrets.OPENHANDS_BOT_GITHUB_PAT_PUBLIC != ''
         env:
-          GH_TOKEN: ${{ secrets.PAT_TOKEN }}
+          GH_TOKEN: ${{ secrets.OPENHANDS_BOT_GITHUB_PAT_PUBLIC }}
         run: |
           gh pr review "${{ steps.cpr.outputs.pull-request-url }}" \
             --approve \
             --body "Auto-approving automated docs sync PR."
 
       - name: Enable auto-merge (squash)
-        if: steps.cpr.outputs.pull-request-url && secrets.PAT_TOKEN != ''
+        if: steps.cpr.outputs.pull-request-url && secrets.OPENHANDS_BOT_GITHUB_PAT_PUBLIC != ''
         env:
-          GH_TOKEN: ${{ secrets.PAT_TOKEN }}
+          GH_TOKEN: ${{ secrets.OPENHANDS_BOT_GITHUB_PAT_PUBLIC }}
         run: |
           PR_URL="${{ steps.cpr.outputs.pull-request-url }}"
 

From 5031f395b9e0001993e4d97bba1f3c0d9aeb6a35 Mon Sep 17 00:00:00 2001
From: simonrosenberg <157206163+simonrosenberg@users.noreply.github.com>
Date: Thu, 23 Apr 2026 16:30:30 -0300
Subject: [PATCH 2/2] chore: use OPENHANDS_BOT_GITHUB_PAT_PUBLIC in
 sync-agent-sdk-openapi.yml

---
 .github/workflows/sync-agent-sdk-openapi.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/sync-agent-sdk-openapi.yml b/.github/workflows/sync-agent-sdk-openapi.yml
index 1062fd88..d69be024 100644
--- a/.github/workflows/sync-agent-sdk-openapi.yml
+++ b/.github/workflows/sync-agent-sdk-openapi.yml
@@ -114,21 +114,21 @@ jobs:
 
             **Note**: This is an automated pull request. Please review the changes to ensure they are correct before merging.
 
-      # Auto-approve using PAT_TOKEN (all-hands-bot). PR is created by
+      # Auto-approve using OPENHANDS_BOT_GITHUB_PAT_PUBLIC (all-hands-bot). PR is created by
       # github-actions[bot], so a different identity (all-hands-bot) can approve it.
       - name: Auto-approve PR
-        if: steps.cpr.outputs.pull-request-url && secrets.PAT_TOKEN != ''
+        if: steps.cpr.outputs.pull-request-url && secrets.OPENHANDS_BOT_GITHUB_PAT_PUBLIC != ''
         env:
-          GH_TOKEN: ${{ secrets.PAT_TOKEN }}
+          GH_TOKEN: ${{ secrets.OPENHANDS_BOT_GITHUB_PAT_PUBLIC }}
         run: |
           gh pr review "${{ steps.cpr.outputs.pull-request-url }}" \
             --approve \
             --body "Auto-approving automated OpenAPI sync PR."
 
       - name: Enable auto-merge (squash)
-        if: steps.cpr.outputs.pull-request-url && secrets.PAT_TOKEN != ''
+        if: steps.cpr.outputs.pull-request-url && secrets.OPENHANDS_BOT_GITHUB_PAT_PUBLIC != ''
         env:
-          GH_TOKEN: ${{ secrets.PAT_TOKEN }}
+          GH_TOKEN: ${{ secrets.OPENHANDS_BOT_GITHUB_PAT_PUBLIC }}
         run: |
           PR_URL="${{ steps.cpr.outputs.pull-request-url }}"