From 6fe6c7a5b5f9c4acfa617929a6e63f46a0fceca6 Mon Sep 17 00:00:00 2001
From: dovholuknf <46322585+dovholuknf@users.noreply.github.com>
Date: Mon, 17 Aug 2026 12:57:29 -0400
Subject: [PATCH] trying to fix stargazers again

---
 .github/workflows/publish.yml | 23 +++++++----------------
 1 file changed, 7 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 6a417e1..5c813cd 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -114,25 +114,16 @@ jobs:
           ZITI_CI_GH_KEY: ${{ secrets.ZITI_CI_GH_KEY }}
           JENKINS_CI_BB_KEY: ${{ secrets.JENKINS_CI_BB_KEY }}
 
-      # Mint a short-lived token from the openziti-stargazer-audit GitHub App
-      # (installed org-wide, metadata:read). GitHub's 2026-06-30 restriction blocks
-      # PATs from the List-Stargazers endpoint, so an App installation token is the
-      # only maintenance-free way to read it. owner: openziti scopes the token to
-      # that org's installation (all repos, including future ones).
-      - name: Mint stargazer App token
-        id: star-token
-        uses: actions/create-github-app-token@v1
-        with:
-          app-id: ${{ secrets.STARGAZER_APP_ID }}
-          private-key: ${{ secrets.STARGAZER_APP_PRIVATE_KEY }}
-          owner: openziti
-
       - name: Build & Publish Docusaurus Site
         env:
           GITHUB_TOKEN: ${{ github.token }}
-          # gh-stats.sh reads the stargazer API via this (mapped to GH_TOKEN). It's the
-          # App installation token minted above -- see the "Mint stargazer App token" step.
-          STARGAZERS_READ_TOKEN: ${{ steps.star-token.outputs.token }}
+          # gh-stats.sh (openziti/ziti-doc) reads the stargazer API via this, mapped to
+          # GH_TOKEN. It has to be a CLASSIC PAT on an account with admin on the openziti
+          # repos: GitHub restricts stargazer data to admins and collaborators, and admin
+          # access alone isn't enough -- a fine-grained PAT on the same account and an
+          # org-wide App installation token are both refused. See STARGAZERS.md in
+          # openziti/ziti-doc.
+          ZITI_CI_STARGAZERS_READ_TOKEN: ${{ secrets.ZITI_CI_STARGAZERS_READ_TOKEN }}
           ZITI_HOTJAR_APPID: ${{ secrets.PROD_DOC_HOTJAR_APPID }}
           DEPLOY_ENV: 'kinsta'
           DOCUSAURUS_URL: 'https://netfoundry.io'