From 13a8931f58b3149e2761a4d4e960519b7a3bf6e4 Mon Sep 17 00:00:00 2001
From: bwp91 <43026681+bwp91@users.noreply.github.com>
Date: Tue, 28 Jul 2026 16:45:28 +0100
Subject: [PATCH] fix(github): use the same coveralls token in both halves of
 the coverage run

---
 .github/workflows/nodejs-build-and-test.yml | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/nodejs-build-and-test.yml b/.github/workflows/nodejs-build-and-test.yml
index bde12d2..429c097 100644
--- a/.github/workflows/nodejs-build-and-test.yml
+++ b/.github/workflows/nodejs-build-and-test.yml
@@ -82,7 +82,10 @@ jobs:
         if: ${{ inputs.enable_coverage }}
         uses: coverallsapp/github-action@v2
         with:
-          github-token: ${{ secrets.github_token }}
+          # Use the secret this workflow actually declares, falling back to
+          # the workflow's own token. Reading GITHUB_TOKEN directly meant a
+          # caller could pass `token` and have it silently ignored.
+          github-token: ${{ secrets.token || github.token }}
           flag-name: run-${{ matrix.node_version }}
           parallel: true
 
@@ -240,5 +243,9 @@ jobs:
       - name: Coveralls Finished
         uses: coverallsapp/github-action@v2
         with:
-          github-token: ${{ secrets.token }}
+          # The secret is optional, so fall back to the workflow's own token.
+          # Without this, a caller that enables coverage but omits `token`
+          # uploads every report and then never closes the build off - each
+          # job goes green while Coveralls waits forever for the last one.
+          github-token: ${{ secrets.token || github.token }}
           parallel-finished: true