From 4baf2ed8ada8440b2d9c6cbc93272d4807f94e8e Mon Sep 17 00:00:00 2001
From: ethernet <arilotter@gmail.com>
Date: Wed, 22 Jul 2026 23:23:28 -0400
Subject: [PATCH] fix(ci): authenticate gh-image installation (#69793)

Use the trusted publisher's scoped GitHub token when resolving the pinned
gh-image release. This avoids GitHub-hosted runners exhausting their shared
anonymous API rate limit before the evidence publisher can run.
---
 .github/workflows/publish-e2e-evidence.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/publish-e2e-evidence.yml b/.github/workflows/publish-e2e-evidence.yml
index 23c471ce2642..3d7fe32d7806 100644
--- a/.github/workflows/publish-e2e-evidence.yml
+++ b/.github/workflows/publish-e2e-evidence.yml
@@ -33,6 +33,8 @@ jobs:
 
       # v1.2.0 resolves to 44f4b93ecbbe22de6c45fa2f62f519aee564ca8c.
       - name: Install gh-image
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: gh extension install drogers0/gh-image --pin v1.2.0
 
       - name: Download and attach evidence