From eb766e2d51e24016df00a6ddfb472601f49a43be Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Mon, 25 Aug 2025 21:06:20 +0200
Subject: [PATCH 1/2] ci/github-script: fix run script

Not a problem for prepare/commits, but the labels comand will remove the
temp directory again, before it actually runs the command. Nothing good
will come out of that!
---
 ci/github-script/run | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ci/github-script/run b/ci/github-script/run
index eeaee253ef42..1d974cf5355f 100755
--- a/ci/github-script/run
+++ b/ci/github-script/run
@@ -49,7 +49,7 @@ program
   .option('--no-dry', 'Make actual modifications')
   .action(async (owner, repo, pr, options) => {
     const prepare = (await import('./prepare.js')).default
-    run(prepare, owner, repo, pr, options)
+    await run(prepare, owner, repo, pr, options)
   })
 
 program
@@ -61,7 +61,7 @@ program
   .option('--no-cherry-picks', 'Do not expect cherry-picks.')
   .action(async (owner, repo, pr, options) => {
     const commits = (await import('./commits.js')).default
-    run(commits, owner, repo, pr, options)
+    await run(commits, owner, repo, pr, options)
   })
 
 program
@@ -77,7 +77,7 @@ program
     try {
       process.env.GITHUB_WORKSPACE = tmp
       process.chdir(tmp)
-      run(labels, owner, repo, pr, options)
+      await run(labels, owner, repo, pr, options)
     } finally {
       rmSync(tmp, { recursive: true })
     }

From 979687958f5d57b1d36006fbc769a26427369e73 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Tue, 26 Aug 2025 10:51:23 +0200
Subject: [PATCH 2/2] workflows/labels: prevent error on token creation for
 Test workflow

This only happens when the label workflow runs in pull_request context
*and* from within nixpkgs (not a fork). This is the case for dependabot
updates.
---
 .github/workflows/labels.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index 97049cb08f87..6a2b11c621a1 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -50,7 +50,7 @@ jobs:
 
       # Use a GitHub App, because it has much higher rate limits: 12,500 instead of 5,000 req / hour.
       - uses: actions/create-github-app-token@0f859bf9e69e887678d5bbfbee594437cb440ffe # v2.1.0
-        if: vars.NIXPKGS_CI_APP_ID
+        if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_APP_ID
         id: app-token
         with:
           app-id: ${{ vars.NIXPKGS_CI_APP_ID }}