From bebb95885b68a92acac7905aa88c167a9d01abfb Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 26 Jan 2026 01:34:48 +0000
Subject: [PATCH 1/2] Initial plan


From 605b174022f619831112fb5857861e51487a1175 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 26 Jan 2026 01:48:04 +0000
Subject: [PATCH 2/2] Add github-token input to setup-cli action

- Add github-token input parameter with default value ${{ github.token }}
- Pass token as GH_TOKEN environment variable to install.sh
- Update README with usage examples for the new input
- Add test coverage for the github-token input in action.yml

This fixes the issue where gh extension install fails with "set the GH_TOKEN environment variable" error in GitHub Actions workflows.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 actions/setup-cli/README.md                  | 19 +++++++++++++++++++
 actions/setup-cli/action.yml                 |  5 +++++
 pkg/cli/setup_cli_action_integration_test.go | 14 ++++++++++++++
 3 files changed, 38 insertions(+)

diff --git a/actions/setup-cli/README.md b/actions/setup-cli/README.md
index 3c072953079..fd20746ba62 100644
--- a/actions/setup-cli/README.md
+++ b/actions/setup-cli/README.md
@@ -54,6 +54,14 @@ The version of gh-aw to install. Must be a release tag.
 
 - **Release tag**: e.g., `v0.37.18`, `v0.37.0`
 
+### `github-token` (optional)
+
+GitHub token for authentication. Used for both `gh` CLI operations and GitHub API calls.
+
+- **Default**: `${{ github.token }}` (automatically provided by GitHub Actions)
+- **Required**: No (uses the default GITHUB_TOKEN automatically)
+- **When to override**: Only needed in special cases like using a PAT with additional permissions
+
 ## Outputs
 
 ### `installed-version`
@@ -134,6 +142,17 @@ jobs:
         run: gh aw compile workflow.md
 ```
 
+### Using a Custom GitHub Token
+
+```yaml
+- uses: githubnext/gh-aw/actions/setup-cli@main
+  with:
+    version: v0.37.18
+    github-token: ${{ secrets.MY_CUSTOM_TOKEN }}
+```
+
+**Note**: In most cases, you don't need to specify the `github-token` input. The action automatically uses `${{ github.token }}` which is provided by GitHub Actions.
+
 ## Troubleshooting
 
 ### "Release X does not exist"
diff --git a/actions/setup-cli/action.yml b/actions/setup-cli/action.yml
index 48f62448c35..c4e13fb2153 100644
--- a/actions/setup-cli/action.yml
+++ b/actions/setup-cli/action.yml
@@ -6,6 +6,10 @@ inputs:
   version:
     description: 'Version to install (release tag like v0.37.18)'
     required: true
+  github-token:
+    description: 'GitHub token for authentication (used for gh CLI and API calls)'
+    required: false
+    default: ${{ github.token }}
 
 outputs:
   installed-version:
@@ -18,6 +22,7 @@ runs:
       shell: bash
       env:
         INPUT_VERSION: ${{ inputs.version }}
+        GH_TOKEN: ${{ inputs.github-token }}
       run: ${{ github.action_path }}/install.sh
 
 branding:
diff --git a/pkg/cli/setup_cli_action_integration_test.go b/pkg/cli/setup_cli_action_integration_test.go
index 31d532566c5..224e5261707 100644
--- a/pkg/cli/setup_cli_action_integration_test.go
+++ b/pkg/cli/setup_cli_action_integration_test.go
@@ -155,6 +155,7 @@ func TestSetupCLIActionYAML(t *testing.T) {
 		"installed-version:",
 		"runs:",
 		"using: 'composite'",
+		"github-token:",
 	}
 
 	for _, field := range requiredFields {
@@ -168,6 +169,19 @@ func TestSetupCLIActionYAML(t *testing.T) {
 		t.Errorf("version input should be required")
 	}
 
+	// Verify github-token has default value
+	if !strings.Contains(contentStr, "github-token:") {
+		t.Errorf("action.yml should define github-token input")
+	}
+	if !strings.Contains(contentStr, "default: ${{ github.token }}") {
+		t.Errorf("github-token should have default value of github.token")
+	}
+
+	// Verify GH_TOKEN environment variable is set
+	if !strings.Contains(contentStr, "GH_TOKEN:") {
+		t.Errorf("action.yml should set GH_TOKEN environment variable")
+	}
+
 	// Verify no SHA mention (only release tags)
 	if strings.Contains(strings.ToLower(contentStr), "sha") && !strings.Contains(contentStr, "SHA256") {
 		t.Errorf("action.yml should not mention SHA support (only release tags)")