From 9bb64b112054727985cd83051db12d43f99dfec9 Mon Sep 17 00:00:00 2001
From: leecoder <leecoder@aol.com>
Date: Tue, 8 Sep 2026 14:57:05 +0900
Subject: [PATCH] ci(workflow): drop the PAT - use the built-in token per repo

The monitor used to run on the fork and open PRs against upstream,
which structurally requires a cross-repo PAT. Two changes remove it:

- PRs are created in whichever repo the workflow runs in
  (GITHUB_REPOSITORY), so the built-in github.token covers both push
  and pr create - same pattern as upstream's
  auto_update_price_and_context_window workflow
- the job guard flips: upstream owns the merged schedule
  (github.repository == BerriAI/litellm), the fork stays dispatch-only,
  so the two never race on the same base

The script bootstrap from the fork branch stays until #38950 lands
upstream. DBX_MONITOR_TOKEN secret is no longer referenced.
---
 .../workflows/monitor_databricks_pricing.yml  | 38 ++++++++++---------
 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/monitor_databricks_pricing.yml b/.github/workflows/monitor_databricks_pricing.yml
index 340aba1727b..01ed6112c6c 100644
--- a/.github/workflows/monitor_databricks_pricing.yml
+++ b/.github/workflows/monitor_databricks_pricing.yml
@@ -1,8 +1,10 @@
 name: Monitor Databricks Pricing
 
-# Runs on the leecoder/litellm fork on a daily schedule. When the official
-# Databricks pricing pages drift from the registry, the monitor opens a PR
-# against the upstream repo (BerriAI/litellm) from a fork branch.
+# Daily monitor of the Databricks Foundation Model Serving pricing pages.
+# Before PR #38950 merges this workflow only lives on the leecoder/litellm
+# fork (manual dispatch); after the merge it runs on BerriAI/litellm's cron.
+# PRs are always created in the repository the workflow runs in, so the
+# built-in GITHUB_TOKEN is sufficient - no PAT or secret required.
 on:
   schedule:
     - cron: "0 2 * * *" # daily 02:00 UTC
@@ -10,18 +12,19 @@ on:
 
 permissions:
   contents: write
+  pull-requests: write
 
 env:
-  FORK_REPO: leecoder/litellm
   UPSTREAM_REPO: BerriAI/litellm
   UPSTREAM_BASE: litellm_internal_staging
-  # carries the monitor script until PR #38950 lands upstream
+  # branch that carries the monitor script until PR #38950 lands upstream
   SCRIPT_REF: feat/dbx-pricing-monitor-clean
 
 jobs:
   monitor-db-pricing:
-    # cron would fire on both repos after merge; only the fork may open PRs, or they'd race
-    if: github.repository == 'leecoder/litellm'
+    # once merged the cron fires on both repos; upstream owns the schedule,
+    # the fork stays dispatch-only so the two never race on the same base
+    if: github.repository == 'BerriAI/litellm' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
@@ -35,7 +38,7 @@ jobs:
         run: |
           if [ ! -f scripts/monitor_databricks_pricing.py ]; then
             mkdir -p scripts
-            curl -fsSL "https://raw.githubusercontent.com/${FORK_REPO}/${SCRIPT_REF}/scripts/monitor_databricks_pricing.py" \
+            curl -fsSL "https://raw.githubusercontent.com/leecoder/litellm/${SCRIPT_REF}/scripts/monitor_databricks_pricing.py" \
               -o scripts/monitor_databricks_pricing.py
           fi
 
@@ -56,28 +59,27 @@ jobs:
             echo "changed=true" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Open PR on upstream if changed
+      - name: Open PR if changed
         if: steps.monitor.outputs.changed == 'true'
         env:
-          GH_TOKEN: ${{ secrets.DBX_MONITOR_TOKEN }} # leecoder PAT with repo + workflow scopes
-          GITHUB_TOKEN_FOR_PUSH: ${{ secrets.DBX_MONITOR_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
+          GITHUB_TOKEN_FOR_PUSH: ${{ github.token }}
         run: |
           BRANCH="monitor-dbx-pricing-$(date +'%Y-%m-%d')"
-          git config user.name "leecoder"
-          git config user.email "leecoder@aol.com"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git checkout -b "$BRANCH"
           git add model_prices_and_context_window.json litellm/model_prices_and_context_window_backup.json
           git commit -m "chore(model_prices): refresh Databricks Foundation Model Serving rates - automated monitor detected changed DBU rates on the Databricks pricing pages; refreshed the mapped databricks/* entries."
-          git remote add fork "https://x-access-token:${GITHUB_TOKEN_FOR_PUSH}@github.com/${FORK_REPO}.git"
-          git push fork "HEAD:refs/heads/$BRANCH"
+          git push "https://x-access-token:${GITHUB_TOKEN_FOR_PUSH}@github.com/${GITHUB_REPOSITORY}.git" "HEAD:refs/heads/$BRANCH"
           {
             cat /tmp/dbx_monitor_pr_body.md
             echo
             echo "---"
-            echo "Auto-generated by the Databricks pricing monitor running on the ${FORK_REPO} fork. \`PROMO_SKIPPED\`/\`REVIEW\`/\`MISSING_FROM_PAGE\` lines need human attention; \`UPDATED\` lines were applied automatically."
+            echo "Auto-generated by the Databricks pricing monitor. \`PROMO_SKIPPED\`/\`REVIEW\`/\`MISSING_FROM_PAGE\` lines need human attention; \`UPDATED\` lines were applied automatically."
           } > /tmp/dbx_pr_body_final.md
-          gh pr create --repo "$UPSTREAM_REPO" \
+          gh pr create --repo "$GITHUB_REPOSITORY" \
             --base "$UPSTREAM_BASE" \
-            --head "leecoder:$BRANCH" \
+            --head "$BRANCH" \
             --title "chore(model_prices): refresh Databricks Foundation Model Serving rates" \
             --body-file /tmp/dbx_pr_body_final.md