ci(release): give changelog-check step a GH token

[Matovidlo]

Summary

The release pipeline's gate job failed with:

subprocess.CalledProcessError: Command '['gh', 'release', 'list', ...]' returned non-zero exit status 4.

Exit code 4 from gh means "not authenticated." The changelog-check step runs scripts/generate_changelog.py --check, which shells out to gh release list. gh only authenticates when a token is in its environment (GH_TOKEN/GITHUB_TOKEN), and this step never set one — so subprocess.run(..., check=True) re-raised the auth failure.

The per-job permission scoping in 16765c5 is what exposed this: the step depends on gh but was left without a token.

Fix

• Add GH_TOKEN: ${{ github.token }} to the changelog-check step.
• The workflow-default contents: read scope already covers listing releases, so no permission change is needed.

Test Plan

• gh returns exit 4 specifically on missing auth; supplying github.token (a trusted built-in) resolves it.
• Verified by inspection: contents: read is sufficient scope for gh release list.
• The next tagged release / workflow_dispatch exercises the gate job end-to-end.

Impact analysis

• .github/workflows/release-kbagent.yml only — single step gains an env block.
• No code, dependency, or runtime behavior change. Release-CI only.
• Fully backwards-compatible.

Related

• Regression introduced by 16765c5 ci(release): scope GITHUB_TOKEN permissions per job.

[Matovidlo]

@claude review

[Copilot]

Pull request overview

This PR fixes an authentication failure in the release-kbagent GitHub Actions workflow by providing a GitHub token to the changelog-check step so that gh release list can run successfully under the workflow’s least-privilege permission model.

Changes:

• Add GH_TOKEN: ${{ github.token }} to the changelog-check step in the gate job.
• Document (inline) that gh release list requires auth and that contents: read is sufficient.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Matovidlo]

@padak fixing this https://github.com/keboola/cli/actions/runs/27820693062/job/82332815507

[padak]

Review of #445 — ci(release): give changelog-check step a GH token

Generated by kbagent-pr-reviewer subagent. Verdict and findings below
are advisory; the human author retains every veto. CI-coverable issues
(lint, format, tests) are confirmed via make check, not duplicated here.

Summary

This PR adds a two-line env block to the changelog-check step in
.github/workflows/release-kbagent.yml, supplying GH_TOKEN: ${{ github.token }}
so that scripts/generate_changelog.py --check can call gh release list
without failing with exit code 4 (unauthenticated). The regression was introduced
by 16765c5, which scoped GITHUB_TOKEN permissions per job, removing the implicit
token injection that existed before. The fix is minimal, correct, and carries no
risk: github.token is the recommended built-in ephemeral token, contents: read
(already the workflow-level default that the gate job inherits) is sufficient for
gh release list, and no other step in gate uses gh without an explicit token.

Verdict: APPROVE. There are zero blocking findings. One informational NIT is noted.

Verdict

• Verdict: APPROVE
• Blocking findings: 0
• Non-blocking findings: 0
• Nits: 1

Blocking findings

(none)

Non-blocking findings

(none)

Nits

• [NIT-1] .github/workflows/release-kbagent.yml:122 (in release.yml, not this PR) — release.yml still uses ${{ secrets.GITHUB_TOKEN }} for its gh release upload step while this PR correctly uses the modern ${{ github.token }} form (no secrets: context needed). The two are functionally identical, but a follow-up consistency pass across all four workflow files would make the pattern uniform and easier to audit.

Verification log

• gh pr view 445 --json title,body,files,additions,deletions,baseRefName,headRefName,labels,state → 1 file, +2/-0, ci(release): prefix matches a CI-workflow fix (not feat/fix/chore mismatch) ✓
• gh pr diff 445 → 13 lines; only .github/workflows/release-kbagent.yml is touched ✓
• git rev-parse --abbrev-ref HEAD → martinvasko-fix-release-changelog-gh-auth (matches PR branch) ✓
• Layer violation grep (typer in services, httpx in commands, formatter in clients) → empty (no Python source changed) ✓
• Plugin synchronization map scan → not applicable; no CLI commands added/removed/renamed ✓
• Security / token discipline: GH_TOKEN: ${{ github.token }} is the built-in ephemeral GitHub Actions token; no hardcoded secret; no real credential pattern in diff ✓
• gate job has no per-job permissions: block → inherits workflow-level permissions: contents: read; this scope is sufficient for gh release list (read-only release metadata) ✓
• No other gh invocation found in the gate job without an explicit token ✓
• Convention checks (magic numbers, bare except, raw error_code strings, print() in src, unmasked token in logs) → all empty (workflow YAML only) ✓
• make check → 4124 passed, 8 skipped ✓ (exit 0; "All checks passed!")

Open questions for the author

(none)

[Matovidlo]

@padak you said approve but no approve given 🤷

[padak]

Approving — CI-only change that gives the changelog-check step a valid GH token. No blocking or non-blocking findings (full review posted above). The single nit (NIT-1: release.yml still using secrets.GITHUB_TOKEN instead of github.token) is out of scope for this PR and can be a follow-up.