feat(deploy-dispatcher-action): check out a private upstream mirror with a caller-supplied token

[debuggingfuture]

Problem

upstream-repo already invites a mirror or private fork ("an enterprise mirror / private fork can override"), but the checkout it feeds cannot reach a private one. The step passes no token:, so actions/checkout falls back to the calling workflow's GITHUB_TOKEN — scoped to the calling repository alone. It reads any public repo, and a private repo one namespace over is a 404 to it. permissions: does not widen this; it only adjusts scopes on the caller's own repo.

A BYOC consumer that mirrors this repo into its own org — so the pinned code stays reachable if upstream is archived, renamed or deleted — must therefore keep the mirror public, or fork the action to add one line.

Take

upstream-token, defaulting to github.token, passed to the checkout as ${{ inputs.upstream-token || github.token }}. A consumer with a private mirror supplies a fine-grained PAT or App installation token carrying Contents: read; everyone else leaves it unset and behaves exactly as today.

The credential stays with the consumer, which is where it belongs — the action never holds or assumes one.

Notes

The action README gains a short "Deploying from a private mirror" section with the three-line with: block, next to the existing inputs table.

[flaredispatch-fractalboxdev]

AI code review — 💬 Comment

Risk tier: lite · 0 critical · 1 warnings · 0 suggestions

Reviewers: security 1 · code-quality 0 · performance 0 · documentation 0

1. ⚠️ Warning — Checkout token is persisted into the checked-out repository

📍 actions/deploy-dispatcher-action/action.yml:159

The new 'upstream-token' is passed to 'actions/checkout' without 'persist-credentials: false', so checkout will write the token into '.git/config' for subsequent steps. Because the checked-out mirror may be untrusted and later action steps execute in its workspace, code or commands run afterward could read and exfiltrate this private-repository credential. Disable credential persistence for this checkout unless later steps explicitly require it.

📋 View full logs & reviewed diff ↗