ci: let the screenshot recorder pull LFS on the private fork

The cached LFS checkout action checks out with persist-credentials: false
and then runs `git lfs pull` on a cache miss. Upstream is public, so that
pull works anonymously; on this private fork it fails with
`could not read Username for 'https://github.com'`, which is why the
Record-Screenshots label never produced a recording here (the only
successful runs were manual dispatches with a warm LFS cache).

Keep the job token configured for both LFS checkout steps. The push of
the recorded goldens already authenticates with the same token.
This commit is contained in:
Sedat Qaja
2026-10-19 16:34:45 +02:00
parent db839dc5c3
commit b0a577d2b2
+8 -4
View File
@@ -60,17 +60,21 @@ jobs:
uses: actions-ecosystem/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0 # v1.3.0 uses: actions-ecosystem/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0 # v1.3.0
with: with:
labels: Record-Screenshots labels: Record-Screenshots
# Private fork: the action checks out and then runs `git lfs pull` on a cache miss. Upstream
# can do that anonymously because it is public; here the pull needs the job token, so the
# credentials must stay configured. Without this the step dies with
# `could not read Username for 'https://github.com'`.
- name: ⏬ Checkout with LFS (PR) - name: ⏬ Checkout with LFS (PR)
if: github.event.label.name == 'Record-Screenshots' if: github.event.label.name == 'Record-Screenshots'
uses: nschloe/action-cached-lfs-checkout@385a8ecc719e50b8c71af6ab01a624b486b7c3bc # v1.2.5 uses: nschloe/action-cached-lfs-checkout@385a8ecc719e50b8c71af6ab01a624b486b7c3bc # v1.2.5 zizmor: ignore[artipacked]
with: with:
persist-credentials: false persist-credentials: true
ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.ref || github.ref }} ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.ref || github.ref }}
- name: ⏬ Checkout with LFS (Branch) - name: ⏬ Checkout with LFS (Branch)
if: github.event_name == 'workflow_dispatch' if: github.event_name == 'workflow_dispatch'
uses: nschloe/action-cached-lfs-checkout@385a8ecc719e50b8c71af6ab01a624b486b7c3bc # v1.2.5 uses: nschloe/action-cached-lfs-checkout@385a8ecc719e50b8c71af6ab01a624b486b7c3bc # v1.2.5 zizmor: ignore[artipacked]
with: with:
persist-credentials: false persist-credentials: true
- name: ☕️ Use JDK 21 - name: ☕️ Use JDK 21
uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
with: with: