pr-review: intermittent fine-grained-PAT pickup on pull_request events (auth-scope guard fails) #561

Parent: #495 · Work type: Fix · Priority: low · Found by post-implementation health check.

Symptom

On markets, a pull_request-event pr-review run (27311242435, 2026-06-10T22:46Z) failed at Verify auth scopes with:

Fine-grained PAT detected — fine-grained PATs are not supported by this workflow.

The run picked up DON_PETRY_BOT_GH_PAT (fine-grained) instead of DON_PETRY_BOT_GH_PAT_CLASSIC. The guard correctly failed loud rather than post a review it can't approve. It is intermittent (~1/8 recent markets runs; surrounded by successes) and self-recovers on the next event.

Notes

• Both PATs are org secrets with visibility: all, so it is not a visibility gap — looks like a transient secret-resolution hiccup specific to some pull_request events; the reusable's GH_TOKEN: classic || fine-grained fallback then resolves to the fine-grained one.
• Not a conversion regression (the @pr-review/stable pin forwards both PATs via secrets: inherit; the fallback logic is pre-existing).
• Low priority: self-recovers, no bad reviews posted. Watch for recurrence; if it persists, consider removing the fine-grained fallback so a missing classic PAT fails fast and obviously rather than intermittently.