From a877f81d3105c764c41982fd109acee9eefd96df Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Fri, 10 Apr 2026 17:29:54 +0000
Subject: [PATCH 1/2] fix: stop invalid preview workflow validation

Co-authored-by: Kent C. Dodds <me+github@kentcdodds.com>
---
 .github/workflows/preview.yml | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml
index 919f0b5c23..87c73edbd5 100644
--- a/.github/workflows/preview.yml
+++ b/.github/workflows/preview.yml
@@ -40,7 +40,6 @@ on:
 permissions:
   contents: read
   pull-requests: write
-  environments: write
 
 concurrency:
   group: >-
@@ -569,8 +568,18 @@ jobs:
           set -euo pipefail
           node tools/ci/preview-resources.ts cleanup --worker-name "$APP_WORKER_NAME"
 
+      - name: ℹ️ Skip GitHub preview environment delete
+        if: >-
+          always() &&
+          secrets.PREVIEW_ENVIRONMENT_GITHUB_TOKEN == ''
+        run: >
+          echo "Skipping GitHub preview environment delete;
+          PREVIEW_ENVIRONMENT_GITHUB_TOKEN is not configured."
+
       - name: 🏷️ Delete GitHub preview environment
-        if: always()
+        if: >-
+          always() &&
+          secrets.PREVIEW_ENVIRONMENT_GITHUB_TOKEN != ''
         uses: actions/github-script@v8.0.0
         env:
           EVENT_NAME: ${{ github.event_name }}
@@ -578,6 +587,7 @@ jobs:
           INPUT_TARGET: ${{ inputs.target }}
           INPUT_PR_NUMBER: ${{ inputs.pr_number }}
         with:
+          github-token: ${{ secrets.PREVIEW_ENVIRONMENT_GITHUB_TOKEN }}
           script: |
             const eventName = process.env.EVENT_NAME;
             let envName;

From 39c05696266f5d268d119027d67f0ee9806f466a Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Fri, 10 Apr 2026 17:31:22 +0000
Subject: [PATCH 2/2] fix: gate preview cleanup token safely

Co-authored-by: Kent C. Dodds <me+github@kentcdodds.com>
---
 .github/workflows/preview.yml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml
index 87c73edbd5..b13f9977ef 100644
--- a/.github/workflows/preview.yml
+++ b/.github/workflows/preview.yml
@@ -454,6 +454,9 @@ jobs:
         github.event.pull_request.head.repo.fork == false) ||
       (github.event_name == 'workflow_dispatch' &&
         inputs.action == 'cleanup')
+    env:
+      PREVIEW_ENVIRONMENT_GITHUB_TOKEN:
+        ${{ secrets.PREVIEW_ENVIRONMENT_GITHUB_TOKEN }}
     steps:
       - name: 📦 Checkout
         uses: actions/checkout@v6.0.2
@@ -571,7 +574,7 @@ jobs:
       - name: ℹ️ Skip GitHub preview environment delete
         if: >-
           always() &&
-          secrets.PREVIEW_ENVIRONMENT_GITHUB_TOKEN == ''
+          env.PREVIEW_ENVIRONMENT_GITHUB_TOKEN == ''
         run: >
           echo "Skipping GitHub preview environment delete;
           PREVIEW_ENVIRONMENT_GITHUB_TOKEN is not configured."
@@ -579,7 +582,7 @@ jobs:
       - name: 🏷️ Delete GitHub preview environment
         if: >-
           always() &&
-          secrets.PREVIEW_ENVIRONMENT_GITHUB_TOKEN != ''
+          env.PREVIEW_ENVIRONMENT_GITHUB_TOKEN != ''
         uses: actions/github-script@v8.0.0
         env:
           EVENT_NAME: ${{ github.event_name }}
@@ -587,7 +590,7 @@ jobs:
           INPUT_TARGET: ${{ inputs.target }}
           INPUT_PR_NUMBER: ${{ inputs.pr_number }}
         with:
-          github-token: ${{ secrets.PREVIEW_ENVIRONMENT_GITHUB_TOKEN }}
+          github-token: ${{ env.PREVIEW_ENVIRONMENT_GITHUB_TOKEN }}
           script: |
             const eventName = process.env.EVENT_NAME;
             let envName;