Merge pull request #66738 from NousResearch/fix/ci-timings-fork-token

fix(ci): make timings report fork-safe (missed by #66577)

.github/workflows/ci.yml

@@ -226,7 +226,10 @@ jobs:
 
       - name: Collect timings and generate report
         env:
-          GITHUB_TOKEN: ${{ secrets.AUTOFIX_BOT_PAT }}
+          # Forks get no repo secrets (AUTOFIX_BOT_PAT is empty); fall back to
+          # the built-in read-only token so the timings API read still works
+          # there instead of hard-failing this advisory job on every fork PR.
+          GITHUB_TOKEN: ${{ secrets.AUTOFIX_BOT_PAT || github.token }}
         run: |
           python3 scripts/ci/timings_report.py \
             --baseline ci-timings-baseline.json \

scripts/ci/timings_report.py

@@ -923,11 +923,17 @@ def main():
         with open(args.from_json, encoding="utf-8") as f:
             timings = json.load(f)
     else:
-        token = expect_env("GITHUB_TOKEN")
         repo = expect_env("GITHUB_REPOSITORY")
         run_id = expect_env("GITHUB_RUN_ID")
         head_sha = expect_env("GITHUB_SHA")
         try:
+            # A missing token (e.g. an empty PAT on a fork PR, where repo
+            # secrets are unavailable) is a degraded run, not a hard error:
+            # route it through the same soft-fail path so this advisory job
+            # never reddens the PR.
+            token = os.environ.get("GITHUB_TOKEN")
+            if not token:
+                raise TimingsUnavailable("GITHUB_TOKEN is empty")
             timings = collect_timings(token, repo, run_id, head_sha)
         except TimingsUnavailable as e:
             # Observability job: a missing report must never redden the PR.