From 02707ddd6a3bfa60538d313054d3605b2712b155 Mon Sep 17 00:00:00 2001
From: Arkadiusz Fal <arek@arekf.net>
Date: Sat, 18 Jul 2026 18:40:09 +0200
Subject: [PATCH] Fix AltStore source push rejected by branch protection

The update_altstore job pushed with the default GITHUB_TOKEN, which
cannot bypass the changes-through-PR ruleset on main. Check out with
REPO_TOKEN like the release and appcast jobs, and forward secrets to
the reusable workflow with secrets: inherit.
---
 .github/workflows/release.yml         | 1 +
 .github/workflows/update-altstore.yml | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c38b7b86..48db1a54 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -349,5 +349,6 @@ jobs:
     if: ${{ inputs.build_ios && success() }}
     needs: [release]
     uses: ./.github/workflows/update-altstore.yml
+    secrets: inherit
     with:
       tag: ${{ needs.release.outputs.tag }}
diff --git a/.github/workflows/update-altstore.yml b/.github/workflows/update-altstore.yml
index 822a450c..1610e7cf 100644
--- a/.github/workflows/update-altstore.yml
+++ b/.github/workflows/update-altstore.yml
@@ -22,6 +22,9 @@ jobs:
       - uses: actions/checkout@v4
         with:
           ref: main
+          # Default GITHUB_TOKEN cannot bypass the "changes through PR only"
+          # branch ruleset; REPO_TOKEN can (same as the release workflow).
+          token: ${{ secrets.REPO_TOKEN }}
       - name: Get version info from release
         run: |
           TAG="${{ inputs.tag }}"