From 4b0692c6090b0237bf24173b1029a5856e252e44 Mon Sep 17 00:00:00 2001
From: Ibraheem Amin <68827140+DIodide@users.noreply.github.com>
Date: Sun, 5 Jul 2026 14:37:29 -0400
Subject: [PATCH] ci(deploy): set GITHUB_TOKEN on the Convex deployment during
 frontend-cd (#163)

The skill-repo import (convex/skills.ts: listRepoSkills / importSkillRepo /
ensureSkillDetails) calls the GitHub API from Convex egress. Without a
GITHUB_TOKEN env var on the deployment it shares the anonymous 60/req/hr limit
and fails (the browse dialog shows a rate-limit error / no skills).

The token had never been set on the app's real Convex deployment
(incredible-otter-96): a manual `convex env set --prod` from this repo targets
a DIFFERENT project (dusty-echidna-658) that the repo happens to be linked to,
not the one CONVEX_DEPLOY_KEY / VITE_CONVEX_URL point at. Fix it the durable
way: right after `convex deploy`, set GITHUB_TOKEN on the SAME deployment the
deploy key targets (prod on main, staging otherwise) from the existing
SKILLS_GITHUB_TOKEN secret. Idempotent, rotates with the secret, fail-soft
when unset. Mirrors the FastAPI host token step (#160).
---
 .github/workflows/frontend-cd.yml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/.github/workflows/frontend-cd.yml b/.github/workflows/frontend-cd.yml
index 6bf2c9e..358c3eb 100644
--- a/.github/workflows/frontend-cd.yml
+++ b/.github/workflows/frontend-cd.yml
@@ -31,6 +31,23 @@ jobs:
         env:
           CONVEX_DEPLOY_KEY: ${{ secrets.CONVEX_DEPLOY_KEY }}
 
+      - name: Set Convex GITHUB_TOKEN for skill imports
+        # skills.ts (repo skill import / SKILL.md fetch) calls the GitHub API
+        # from Convex egress — without a token it shares the 60/req/hr anon
+        # limit and fails. Set it on the SAME deployment CONVEX_DEPLOY_KEY
+        # targets (prod on main, staging otherwise), idempotently, so it rotates
+        # with the SKILLS_GITHUB_TOKEN secret. Fail-soft when the secret is unset.
+        run: |
+          cd packages/convex-backend
+          if [ -n "$SKILLS_GITHUB_TOKEN" ]; then
+            npx convex env set GITHUB_TOKEN "$SKILLS_GITHUB_TOKEN"
+          else
+            echo "SKILLS_GITHUB_TOKEN not set for this environment — skipping"
+          fi
+        env:
+          CONVEX_DEPLOY_KEY: ${{ secrets.CONVEX_DEPLOY_KEY }}
+          SKILLS_GITHUB_TOKEN: ${{ secrets.SKILLS_GITHUB_TOKEN }}
+
       - name: Determine environment
         id: env
         run: |