From 81ecdf4f20428f2b8e77e853e3c4c6206b6eb62d Mon Sep 17 00:00:00 2001
From: Chris Busillo <info@shinycomputers.com>
Date: Thu, 28 May 2026 18:51:05 -0400
Subject: [PATCH] Prefer source token for artifact selector resolution

---
 odoo_devkit/local_runtime.py |  4 +++-
 tests/test_runtime.py        | 20 ++++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/odoo_devkit/local_runtime.py b/odoo_devkit/local_runtime.py
index c9c5716..02bc99e 100644
--- a/odoo_devkit/local_runtime.py
+++ b/odoo_devkit/local_runtime.py
@@ -2087,7 +2087,9 @@ def resolve_artifact_runtime_source_repository_refs(
     runtime_values: dict[str, str],
 ) -> tuple[dict[str, str], tuple[dict[str, str], ...]]:
     resolved_values = dict(runtime_values)
-    github_token = resolve_github_token_for_build(runtime_values)
+    github_token = clean_optional_value(runtime_values.get("GITHUB_TOKEN")) or first_clean_optional_value(
+        (os.environ.get("GITHUB_TOKEN"), os.environ.get("GH_TOKEN"))
+    )
     selector_metadata: list[dict[str, str]] = []
     for env_key in ARTIFACT_SOURCE_ENV_KEYS:
         raw_value = runtime_values.get(env_key, "")
diff --git a/tests/test_runtime.py b/tests/test_runtime.py
index 7de16e5..17986f2 100644
--- a/tests/test_runtime.py
+++ b/tests/test_runtime.py
@@ -1645,6 +1645,26 @@ def test_resolve_artifact_runtime_source_refs_uses_environment_token_fallback(se
             ),
         )
 
+    def test_resolve_artifact_runtime_source_refs_prefers_runtime_github_token(self) -> None:
+        runtime_values = {
+            "GITHUB_TOKEN": "source-token",
+            "ODOO_ADDON_REPOSITORIES": "cbusillo/disable_odoo_online@main",
+        }
+        with mock.patch.dict(os.environ, {"GHCR_TOKEN": "package-token", "GITHUB_TOKEN": "env-token"}):
+            with mock.patch(
+                "odoo_devkit.local_runtime.resolve_source_repository_ref_to_git_sha",
+                return_value="411f6b8e85cac72dc7aa2e2dc5540001043c327d",
+            ) as resolve_ref_mock:
+                local_runtime.resolve_artifact_runtime_source_repository_refs(
+                    runtime_values=runtime_values
+                )
+
+        resolve_ref_mock.assert_called_once_with(
+            repository="cbusillo/disable_odoo_online",
+            ref="main",
+            github_token="source-token",
+        )
+
     def test_resolve_source_repository_ref_to_git_sha_rejects_ambiguous_matches(self) -> None:
         ambiguous_stdout = (
             "1111111111111111111111111111111111111111\trefs/heads/main\n2222222222222222222222222222222222222222\trefs/tags/main\n"