nodejs · aduh95 · Aug 9, 2026 · Aug 10, 2026
diff --git a/.github/workflows/auto-start-ci.yml b/.github/workflows/auto-start-ci.yml
@@ -1,3 +1,6 @@
+# This action uses the following secrets:
+#   JENKINS_USER: GitHub user whose Jenkins token is defined below
+#   JENKINS_TOKEN: Jenkins token, to be used to check CI status
 name: Auto Start CI
 
 on:
@@ -36,11 +39,13 @@ jobs:
                   -t '{{ range . }}{{ .number }} {{ end }}' \
                   --limit 5)" >> "$GITHUB_OUTPUT"
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
   start-ci:
     permissions:
+      checks: read
       contents: read
       pull-requests: write
+      statuses: read
     needs: get-prs-for-ci
     if: needs.get-prs-for-ci.outputs.numbers != ''
     runs-on: ubuntu-slim
@@ -59,16 +64,15 @@ jobs:
           ncu-config set token "$GH_TOKEN"
           ncu-config set jenkins_token "$JENKINS_TOKEN"
           ncu-config set owner "$GITHUB_REPOSITORY_OWNER"
-          ncu-config set repo "$(echo "$GITHUB_REPOSITORY" | cut -d/ -f2)"
+          ncu-config set repo "${GITHUB_REPOSITORY#*/}"
         env:
           USERNAME: ${{ secrets.JENKINS_USER }}
-          GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
           JENKINS_TOKEN: ${{ secrets.JENKINS_TOKEN }}
 
       - name: Start the CI
         run: |
           curl -fsSL "https://github.com/${GITHUB_REPOSITORY}/raw/${GITHUB_SHA}/tools/actions/start-ci.sh" \
           | sh -s -- ${{ needs.get-prs-for-ci.outputs.numbers }}
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
+          GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/commit-queue.yml b/.github/workflows/commit-queue.yml
@@ -54,7 +54,7 @@ jobs:
                   jq -r -s 'reduce .[] as $pr ([]; if index($pr) then . else . + [$pr] end) | join(" ")')
           echo "candidates=$candidates" >> "$GITHUB_OUTPUT"
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
   commitQueue:
     needs: get_candidate_prs
     if: needs.get_candidate_prs.outputs.candidates != ''
@@ -65,18 +65,14 @@ jobs:
       statuses: read
     runs-on: ubuntu-slim
     steps:
-      # Install dependencies
       - name: Install Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
+
       - name: Install @node-core/utils
         run: npm install -g @node-core/utils
 
-      - name: Set variables
-        run: |
-          echo "REPOSITORY=$(echo "$GITHUB_REPOSITORY" | cut -d/ -f2)" >> "$GITHUB_ENV"
-
       - name: Configure @node-core/utils
         run: |
           # Keep the config outside the workspace so checkout does not remove it.
@@ -85,7 +81,7 @@ jobs:
           ncu-config --global set username "$USERNAME"
           ncu-config --global set token "$GH_TOKEN"
           ncu-config --global set jenkins_token "$JENKINS_TOKEN"
-          ncu-config --global set repo "${REPOSITORY}"
+          ncu-config --global set repo "${GITHUB_REPOSITORY#*/}"
           ncu-config --global set owner "${GITHUB_REPOSITORY_OWNER}"
         env:
           USERNAME: ${{ secrets.JENKINS_USER }}
@@ -104,8 +100,6 @@ jobs:
             metadata="${RUNNER_TEMP}/metadata-${pr}.json"
             output="${RUNNER_TEMP}/metadata-${pr}.txt"
             if git node metadata "$pr" \
-                    --owner "$GITHUB_REPOSITORY_OWNER" \
-                    --repo "$REPOSITORY" \
                     --readme "$readme" \
                     --json > "$metadata" 2> "$output"; then
               metadata_status=0
@@ -173,7 +167,9 @@ jobs:
       - name: Start the Commit Queue
         if: steps.get_mergeable_prs.outputs.numbers != ''
         run: |
+          git config --local user.email "github-bot@iojs.org"
+          git config --local user.name "Node.js GitHub Bot"
           ncu-config set token "$GH_TOKEN"
-          ./tools/actions/commit-queue.sh "${GITHUB_REPOSITORY_OWNER}" "${REPOSITORY}" ${{ steps.get_mergeable_prs.outputs.numbers }}
+          ./tools/actions/commit-queue.sh ${{ steps.get_mergeable_prs.outputs.numbers }}
         env:
           GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}
diff --git a/tools/actions/commit-queue.sh b/tools/actions/commit-queue.sh
@@ -2,47 +2,39 @@
 
 set -xe
 
-OWNER=$1
-REPOSITORY=$2
-shift 2
-
 UPSTREAM=origin
 DEFAULT_BRANCH=main
 
 COMMIT_QUEUE_LABEL="commit-queue"
 COMMIT_QUEUE_FAILED_LABEL="commit-queue-failed"
 
+cqurl="${GITHUB_SERVER_URL?:}/${GITHUB_REPOSITORY:?}/actions/runs/${GITHUB_RUN_ID?:}"
+
 commit_queue_failed() {
   pr=$1
 
-  gh pr edit "$pr" --add-label "${COMMIT_QUEUE_FAILED_LABEL}" --remove-label "${COMMIT_QUEUE_LABEL}"
+  gh -R "$GITHUB_REPOSITORY" pr edit "$pr" --add-label "${COMMIT_QUEUE_FAILED_LABEL}" --remove-label "${COMMIT_QUEUE_LABEL}"
 
-  # shellcheck disable=SC2154
-  cqurl="${GITHUB_SERVER_URL}/${OWNER}/${REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
   body="<details><summary>Commit Queue failed</summary><pre>$(sed -e 's/&/\&amp;/g' -e 's/</\&lt;/g' -e 's/>/\&gt;/g' output)</pre><a href='$cqurl'>$cqurl</a></details>"
   echo "$body"
 
-  gh pr comment "$pr" --body "$body"
+  gh -R "$GITHUB_REPOSITORY" pr comment "$pr" --body "$body"
 
   rm output
 }
 
-# TODO(mmarchini): should this be set with whoever added the label for each PR?
-git config --local user.email "github-bot@iojs.org"
-git config --local user.name "Node.js GitHub Bot"
-
 SHOULD_ABORT=
 
 for pr in "$@"; do
-  gh pr view "$pr" --json labels --jq ".labels" > labels.json
+  gh -R "$GITHUB_REPOSITORY" pr view "$pr" --json labels --jq ".labels" > labels.json
   # Skip PR if CI was requested
   if jq -e 'map(.name) | index("request-ci")' < labels.json; then
     echo "pr ${pr} skipped, waiting for CI to start"
     continue
   fi
 
   # Skip PR if CI is still running
-  if gh pr checks "$pr" | grep -q "\spending\s"; then
+  if gh -R "$GITHUB_REPOSITORY" pr checks "$pr" | grep -q "\spending\s"; then
     echo "pr ${pr} skipped, CI still running"
     continue
   fi
@@ -98,7 +90,7 @@ for pr in "$@"; do
         --arg body "${commit_body}" \
         --arg head "${commit_head}" \
         '{merge_method:"squash",commit_title:$title,commit_message:$body,sha:$head}' |\
-      gh api -X PUT "repos/${OWNER}/${REPOSITORY}/pulls/${pr}/merge" --input -\
+      gh api -X PUT "repos/${GITHUB_REPOSITORY}/pulls/${pr}/merge" --input -\
         --jq 'if .merged then .sha else halt_error end'
     )"; then
       commit_queue_failed "$pr"
@@ -108,12 +100,12 @@ for pr in "$@"; do
 
   rm output
 
-  gh pr comment "$pr" --body "Landed in $commits"
+  gh -R "$GITHUB_REPOSITORY" pr comment "$pr" --body "Landed in $commits"
 
-  [ -z "$MULTIPLE_COMMIT_POLICY" ] && gh pr close "$pr"
+  [ -z "$MULTIPLE_COMMIT_POLICY" ] && gh -R "$GITHUB_REPOSITORY" pr close "$pr"
 
   # Delete the commit queue label (but ignore errors, it's no big deal if a closed PR still has the label)
-  gh pr edit "$pr" --remove-label "$COMMIT_QUEUE_LABEL" || true
+  gh -R "$GITHUB_REPOSITORY" pr edit "$pr" --remove-label "$COMMIT_QUEUE_LABEL" || true
 done
 
 rm -f labels.json
diff --git a/tools/actions/start-ci.sh b/tools/actions/start-ci.sh
@@ -4,9 +4,10 @@ set -xe
 
 REQUEST_CI_LABEL="request-ci"
 REQUEST_CI_FAILED_LABEL="request-ci-failed"
+cqurl="${GITHUB_SERVER_URL?:}/${GITHUB_REPOSITORY?:}/actions/runs/${GITHUB_RUN_ID?:}"
 
 for pr in "$@"; do
-  gh pr edit "$pr" --remove-label "$REQUEST_CI_LABEL"
+  gh -R "$GITHUB_REPOSITORY" pr edit "$pr" --remove-label "$REQUEST_CI_LABEL"
 
   ci_started=yes
   rm -f output;
@@ -15,14 +16,12 @@ for pr in "$@"; do
 
   if [ "$ci_started" = "no" ]; then
     # Do we need to reset?
-    gh pr edit "$pr" --add-label "$REQUEST_CI_FAILED_LABEL"
+    gh -R "$GITHUB_REPOSITORY" pr edit "$pr" --add-label "$REQUEST_CI_FAILED_LABEL"
 
-    # shellcheck disable=SC2154
-    cqurl="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
     body="<details><summary>Failed to start CI</summary><pre>$(cat output)</pre><a href='$cqurl'>$cqurl</a></details>"
     echo "$body"
 
-    gh pr comment "$pr" --body "$body"
+    gh -R "$GITHUB_REPOSITORY" pr comment "$pr" --body "$body"
 
     rm output
   fi