ci: use HAYSTACK_BOT_TOKEN for CLA draft gate

[julian-risch]

Related Issues

• Follow-up to ci: gate first-time contributor PRs on CLA, sync linked issues, warn on duplicate PRs #11995. Root-caused on fix: warm child Toolset before flattening in Toolset.add() #12036.

Proposed Changes:

The CLA draft gate on #12036 correctly posted the comment, removed the reviewer, and added the cla-pending label — but the PR was never converted to draft. The workflow run logs show why:

##[warning]PR #12036: Request failed due to following response errors:
 - Resource not accessible by integration

The convertPullRequestToDraft / markPullRequestReadyForReview GraphQL mutations require a user token; GitHub App installation tokens like GITHUB_TOKEN cannot call them, regardless of the granted pull-requests: write permission. This switches the workflow to secrets.HAYSTACK_BOT_TOKEN (already used by release.yml and update-platform-components.yml), with no silent fallback to GITHUB_TOKEN so a missing secret fails loudly instead of half-gating PRs again.

Side effects, both intentional:

• Gate/restore actions (comments, labels, draft toggles, review requests) now show as the bot account instead of github-actions[bot].
• Because PAT-initiated events trigger workflows (unlike GITHUB_TOKEN events), the ready_for_review/review_requested events emitted by restore() now correctly trigger the linked_issue_review workflow after a contributor signs the CLA.

How did you test it?

• Root cause confirmed from the cla_draft_gate run logs (runs 29559061351, 29542596075) and the state of fix: warm child Toolset before flattening in Toolset.add() #12036 (labeled + commented but not drafted).
• actionlint via pre-commit passed. The mutation itself can only be verified once this is on main, on the next PR the sweep gates.

Notes for the reviewer

• Requires HAYSTACK_BOT_TOKEN to be a classic PAT with repo scope (it creates branches/PRs in release.yml, so it should be).

Checklist

• I have read the contributors guidelines and the code of conduct.
• No release note: CI-only change, not user-facing.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
haystack-docs	Ignored		Jul 17, 2026 7:12am