fix(docs-sync): reuse CROSS_REPO_ACCESS_TOKEN for cloud reviewer ranking

.github/docs-sync/reviewers.mjs

@@ -127,7 +127,7 @@ export async function computeSurfaceReviewers(
   try {
     if (cloudRepos.length > 0 && !cloudToken) {
       const err = new Error(
-        `a token with contents: read on ${cloudRepos.join(", ")} is required (repository secret DOCS_SYNC_CLOUD_TOKEN, exposed as CLOUD_REPO_TOKEN)`,
+        `a token with contents: read on ${cloudRepos.join(", ")} is required (repository secret CROSS_REPO_ACCESS_TOKEN, exposed as CLOUD_REPO_TOKEN)`,
       )
       err.code = "CLOUD_TOKEN_REQUIRED"
       throw err
@@ -196,7 +196,7 @@ export async function computeSurfaceReviewers(
         .map((r) => `@${r}`)
         .join(
           " and ",
-        )}; set repository secret DOCS_SYNC_CLOUD_TOKEN (exposed as CLOUD_REPO_TOKEN) with contents: read on ${cloudRepos.join(", ")}.`,
+        )}; set repository secret CROSS_REPO_ACCESS_TOKEN (exposed as CLOUD_REPO_TOKEN) with contents: read on ${cloudRepos.join(", ")}.`,
       sourcePrefixes: prefixes,
     }
   }

.github/docs-sync/selftest.mjs

@@ -4334,7 +4334,7 @@ function case22_cloudSurfacePrFromCloudHistory() {
     assert.deepEqual(reviewers, ["nina", "omar"], "cloud-mobile reviewers come from cloud-repo history")
     assert.match(create.body.body, /ranked from `Kilo-Org\/cloud` git history over `apps\/mobile\/`/)
     assert.ok(create.body.body.includes("Kilo-Org/cloud"), "the PR body must name the cloud repo")
-    assert.ok(create.body.body.includes("DOCS_SYNC_CLOUD_TOKEN"), "the PR body must name the cloud token secret")
+    assert.ok(create.body.body.includes("CROSS_REPO_ACCESS_TOKEN"), "the PR body must name the cloud token secret")
     console.log(`  cloud-mobile PR reviewers: ${reviewers.join(", ")}`)
   } finally {
     stub.child.kill()
@@ -4363,7 +4363,7 @@ function case23_cloudHistoryUnreachableFallsBack() {
       "an unreachable cloud history must fall back to the fixed other pair",
     )
     assert.match(create.body.body, /fixed `other` reviewers/i, "the body must name the fallback")
-    assert.ok(create.body.body.includes("DOCS_SYNC_CLOUD_TOKEN"), "the body must name the required secret")
+    assert.ok(create.body.body.includes("CROSS_REPO_ACCESS_TOKEN"), "the body must name the required secret")
     assert.ok(create.body.body.includes("Kilo-Org/cloud"), "the body must name the cloud repo")
     console.log(`  unreachable cloud history -> reviewers: ${reviewers.join(", ")}`)
   } finally {

.github/docs-sync/surfaces.test.mjs

@@ -358,7 +358,7 @@ test("an unreachable cloud history falls back to the fixed other pair, never thr
   assert.deepEqual(result.sourcePrefixes, ["apps/web/"])
   assert.match(result.note, /Kilo-Org\/cloud/)
   assert.match(result.note, /fixed `other` reviewers/)
-  assert.match(result.note, /DOCS_SYNC_CLOUD_TOKEN/)
+  assert.match(result.note, /CROSS_REPO_ACCESS_TOKEN/)
   assert.match(result.note, /CLOUD_REPO_TOKEN/)
 })
 
@@ -380,7 +380,7 @@ test("a cloud surface with no token falls back before making any call", async ()
     assert.equal(calls, 0)
     assert.deepEqual(result.reviewers, ["lambertjosh", "intentionally-left-nil"])
     assert.equal(result.fallback, true)
-    assert.match(result.note, /DOCS_SYNC_CLOUD_TOKEN/)
+    assert.match(result.note, /CROSS_REPO_ACCESS_TOKEN/)
   } finally {
     if (saved !== undefined) process.env.CLOUD_REPO_TOKEN = saved
     else delete process.env.CLOUD_REPO_TOKEN

.github/docs-sync/upsert-pr.mjs

@@ -446,7 +446,7 @@ export function surfaceBlock({ name, map, reviewers, note }) {
     `- Paths that fall to \`${other}\`: ${list(otherPaths)}`,
     ...(repos.length > 0
       ? [
-          `- Reviewers are ranked from ${list(repos)}; the workflow needs a token with \`contents: read\` on that repository (repository secret \`DOCS_SYNC_CLOUD_TOKEN\`, exposed to the upsert step as \`CLOUD_REPO_TOKEN\`).`,
+          `- Reviewers are ranked from ${list(repos)}; the workflow needs a token with \`contents: read\` on that repository (repository secret \`CROSS_REPO_ACCESS_TOKEN\`, exposed to the upsert step as \`CLOUD_REPO_TOKEN\`).`,
         ]
       : []),
     `- How the two were computed: ${note}`,

.github/workflows/docs-sync.yml

@@ -242,9 +242,9 @@ jobs:
         if: (steps.worthy.outputs.count || '0') != '0' && inputs.dry_run != true
         env:
           GH_TOKEN: ${{ github.token }}
-          # Read-only token for the private Kilo-Org/cloud history; a cloud
-          # surface falls back to the fixed `other` reviewers when it is unset.
-          CLOUD_REPO_TOKEN: ${{ secrets.DOCS_SYNC_CLOUD_TOKEN }}
+          # Read-only token for the Kilo-Org/cloud history; a cloud surface
+          # falls back to the fixed `other` reviewers when it is unset.
+          CLOUD_REPO_TOKEN: ${{ secrets.CROSS_REPO_ACCESS_TOKEN }}
           LEARNED_THROUGH: ${{ steps.learn.outputs.learned_through }}
           PROCESSED_THROUGH: ${{ steps.wm.outputs.now }}
           SINCE: ${{ steps.wm.outputs.since }}