fix(ci): fall back to the existing repo PAT for docs publication

The migrated workflows required LANGBOT_WIKI_PUSH_TOKEN, which only exists in
the langbot-docs repository. The existing RELEASE_UPLOAD_GITHUB_TOKEN was
verified to authenticate as the owner with repo scope plus push/admin on
LangBot, langbot-docs, langbot-landing-page and the production fork, and it can
push the Wiki, so publication now falls back to it when the dedicated secret is
absent. Also retarget the cutover notes at the master branch.

Co-Authored-By: Mika (Multica) <[email protected]>
Co-authored-by: multica-agent <[email protected]>

.github/workflows/sync-blog-articles.yml

@@ -27,7 +27,7 @@ jobs:
           ref: master
           fetch-depth: 0
           # A PAT push triggers the mirror and Wiki workflows; GITHUB_TOKEN does not.
-          token: ${{ secrets.LANGBOT_WIKI_PUSH_TOKEN }}
+          token: ${{ secrets.LANGBOT_WIKI_PUSH_TOKEN || secrets.RELEASE_UPLOAD_GITHUB_TOKEN }}
       - uses: actions/setup-node@v7
         with:
           node-version: '24'
@@ -38,7 +38,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           repository: langbot-app/langbot-landing-page
-          token: ${{ secrets.LANGBOT_WIKI_PUSH_TOKEN }}
+          token: ${{ secrets.LANGBOT_WIKI_PUSH_TOKEN || secrets.RELEASE_UPLOAD_GITHUB_TOKEN }}
           path: .article-source
           persist-credentials: false
       - name: Synchronize articles and images

.github/workflows/sync-github-wiki.yml

@@ -68,7 +68,7 @@ jobs:
           path: generated
       - name: Clone target Wiki
         env:
-          WIKI_PUSH_TOKEN: ${{ secrets.LANGBOT_WIKI_PUSH_TOKEN }}
+          WIKI_PUSH_TOKEN: ${{ secrets.LANGBOT_WIKI_PUSH_TOKEN || secrets.RELEASE_UPLOAD_GITHUB_TOKEN }}
         run: |
           test -n "$WIKI_PUSH_TOKEN"
           git clone "https://x-access-token:${WIKI_PUSH_TOKEN}@github.com/langbot-app/LangBot.wiki.git" target

.github/workflows/sync-landing-submodule.yml

@@ -29,7 +29,7 @@ jobs:
         run: python3 -m unittest discover -s tests -p test_sync_landing_submodule.py -v
       - name: Publish docs subtree (fast-forward only)
         env:
-          GH_TOKEN: ${{ secrets.LANGBOT_WIKI_PUSH_TOKEN }}
+          GH_TOKEN: ${{ secrets.LANGBOT_WIKI_PUSH_TOKEN || secrets.RELEASE_UPLOAD_GITHUB_TOKEN }}
         run: |
           gh auth setup-git
           git remote add docs-mirror https://github.com/langbot-app/langbot-docs.git
@@ -40,5 +40,5 @@ jobs:
       - name: Update landing submodule and production fork
         working-directory: docs
         env:
-          GH_TOKEN: ${{ secrets.LANGBOT_WIKI_PUSH_TOKEN }}
+          GH_TOKEN: ${{ secrets.LANGBOT_WIKI_PUSH_TOKEN || secrets.RELEASE_UPLOAD_GITHUB_TOKEN }}
         run: python3 scripts/sync-landing-submodule.py

dev-docs/DOCS_MIGRATION.md

@@ -29,19 +29,24 @@ canonical URL `https://langbot.app/docs`.
    `git subtree pull --prefix=docs <mirror-url> main` through another reviewed PR
    before cutover; reapply the inert mirror workflow files if necessary. Never
    force-push or rewrite the mirror history.
-3. Verify `LANGBOT_WIKI_PUSH_TOKEN` is configured in LangBot with existing access
-   to the docs mirror, LangBot Wiki, landing upstream and production fork. The
-   blog job additionally needs to push to LangBot main and trigger workflows.
-   Repository workflow-file updates must be permitted by that token. Do not
-   weaken branch protection to accommodate this migration; use a separately
-   reviewed publication approach if the current token cannot perform the push.
+3. The publication jobs read `LANGBOT_WIKI_PUSH_TOKEN` and fall back to the
+   existing `RELEASE_UPLOAD_GITHUB_TOKEN` when that secret is absent. The fallback
+   was verified on a scratch branch: it authenticates as the repository owner
+   with `repo` scope and push+admin on `LangBot`, `langbot-docs`,
+   `langbot-landing-page` and the production fork, and it can clone and push the
+   Wiki. It does not carry the `workflow` scope, so it cannot push changes to
+   `.github/workflows/**` in the mirror; the split only rewrites `docs/**`
+   content, so this is fine unless a future change edits the inert mirror stubs.
+   Adding a dedicated `LANGBOT_WIKI_PUSH_TOKEN` with the same access keeps the
+   blast radius of the fallback credential out of the docs pipeline. Do not
+   weaken branch protection to accommodate this migration.
 4. Set LangBot repository variable `DOCS_MIRROR_ENABLED=true`. Dispatch
-   `sync-landing-submodule.yml` on main. It fetches full main history, runs
+   `sync-landing-submodule.yml` on master. It fetches full master history, runs
    `git subtree split --prefix=docs`, verifies the current mirror head is an
    ancestor, pushes without force, then advances only landing's `docs` gitlink.
    The first split replaces legacy mirror workflows with inert manual stubs.
 5. Dispatch `sync-github-wiki.yml` and `sync-blog-articles.yml` in LangBot.
-   The blog job now commits only docs article paths to LangBot main using the
+   The blog job now commits only docs article paths to LangBot master using the
    dedicated token, so its push triggers the mirror and Wiki workflows.
 6. Confirm the `docs` gitlink in `langbot-app/langbot-landing-page`, then confirm
    production fork `RockChinQ/LangBot-LandingPage-Vue` matches upstream. This is