Use TRUSTED_SHARED_SOURCE_GITHUB_TOKEN for cross-repo access in CI

Replace github.token with the org-scoped PAT so gh can clone
trusted/docs and other private repos during setup.

Author: mhfs

.github/workflows/ci.yml

@@ -26,7 +26,7 @@ jobs:
         run: bash setup.sh
         env:
           CI: "true"
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ secrets.TRUSTED_SHARED_SOURCE_GITHUB_TOKEN }}
 
       - name: Install bats
         run: sudo apt-get install -y -qq bats
@@ -36,3 +36,5 @@ jobs:
           export PATH="$HOME/.local/bin:$PATH"
           eval "$(mise activate bash)"
           bats test/setup_test.bats
+        env:
+          GH_TOKEN: ${{ secrets.TRUSTED_SHARED_SOURCE_GITHUB_TOKEN }}

setup.sh

@@ -430,7 +430,7 @@ clone_to_work() {
     fmt_ok "$name already at $dir"
   elif gh auth status > /dev/null 2>&1; then
     fmt_install "Cloning $name to $dir"
-    gh repo clone "$repo" "$dir" -- --quiet
+    gh repo clone "$repo" "$dir" -- --quiet || echo "  WARNING: Failed to clone $name. You may not have access."
   else
     echo "  Skipping $name clone (gh not authenticated)."
   fi