From c8c69f9ec04259da846189b8926c6a74e09201c8 Mon Sep 17 00:00:00 2001
From: Alberto Donato <alberto@stacklet.ai>
Date: Tue, 20 Oct 2026 09:10:34 +0200
Subject: [PATCH] fix: unset GH_TOKEN when empty in run-script workflow

### what

Unset the GH_TOKEN var if empty (the token is not passed in)

### why

zizmor thinks the token is there if the var is set, but empty, so it fails

### testing

will test once merged

### docs

n/a
---
 .github/workflows/run-script.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/run-script.yml b/.github/workflows/run-script.yml
index f23a750..9a13e6f 100644
--- a/.github/workflows/run-script.yml
+++ b/.github/workflows/run-script.yml
@@ -59,7 +59,11 @@ jobs:
           key: pre-commit-${{ runner.os }}-${{ hashFiles('.pre-commit-config.yaml') }}
 
       - name: Run
-        run: ${{ inputs.run }} # zizmor: ignore[template-injection] caller-provided script
+        # Some tools reject an empty GH_TOKEN (e.g. zizmor), so unset it rather
+        # than leaving it empty.
+        run: | # zizmor: ignore[template-injection] caller-provided script
+          [ -n "$GH_TOKEN" ] || unset GH_TOKEN
+          ${{ inputs.run }}
         env:
           GH_TOKEN: ${{ inputs.github-token && github.token || '' }}
           # Point prek at the pre-commit cache path so the cache step covers both.