Update to fix error of token

Author: Phlip79

.github/workflows/auto-swap-labels.yml

@@ -2,42 +2,74 @@
 
 name: Auto Swap Labels
 on:
-  pull_request_review:
-    types: [submitted]
   pull_request_target:
     types: [ready_for_review, synchronize]
     branches:
       - main
+  workflow_run:
+    workflows: ["Review Trigger"]
+    types: [completed]
 
 permissions:
   pull-requests: write
   contents: read
+  actions: read
 
 jobs:
   check-approval:
     runs-on: ubuntu-latest
     if: >-
       github.repository == 'NVIDIA/Megatron-LM' &&
-      github.event.pull_request.base.ref == 'main' &&
       (
-        (github.event_name == 'pull_request_review' && github.event.review.state == 'approved') ||
-        (github.event_name == 'pull_request_target' && !github.event.pull_request.draft)
+        (github.event_name == 'pull_request_target' &&
+         github.event.pull_request.base.ref == 'main' &&
+         !github.event.pull_request.draft) ||
+        (github.event_name == 'workflow_run' &&
+         github.event.workflow_run.conclusion == 'success')
       )
     steps:
+      - name: Get PR number from workflow_run
+        id: get-pr
+        if: github.event_name == 'workflow_run'
+        continue-on-error: true
+        uses: actions/download-artifact@v4
+        with:
+          name: pr-number
+          path: pr-number
+          github-token: ${{ github.token }}
+          run-id: ${{ github.event.workflow_run.id }}
+
+      - name: Set PR number
+        id: pr
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_run" ]; then
+            if [ "${{ steps.get-pr.outcome }}" != "success" ]; then
+              echo "No approval artifact found — review was not an approval. Skipping."
+              exit 0
+            fi
+            echo "number=$(cat pr-number/number)" >> $GITHUB_OUTPUT
+          else
+            echo "number=${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
+          fi
+
       - name: Check out repository code
+        if: steps.pr.outputs.number
         uses: actions/checkout@v4
 
       - name: Set up Python
+        if: steps.pr.outputs.number
         uses: actions/setup-python@v5
         with:
           python-version: "3.10"
 
       - name: Install dependencies
+        if: steps.pr.outputs.number
         run: |
           pip install --no-cache-dir PyGithub slack-sdk
 
       - name: Run Auto Swap Labels
+        if: steps.pr.outputs.number
         run: |
           export GH_TOKEN=${{ secrets.PAT }}
-          export PR_NUMBER=${{ github.event.pull_request.number }}
+          export PR_NUMBER=${{ steps.pr.outputs.number }}
           python tests/test_utils/python_scripts/swap_pr_labels.py

.github/workflows/review-trigger.yml

@@ -0,0 +1,28 @@
+# Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+#
+# Lightweight workflow that triggers on review approval, otherwise there is no access to right secret.
+# No secrets needed — just signals auto-swap-labels.yml via workflow_run.
+
+name: Review Trigger
+
+on:
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  signal:
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.review.state == 'approved' &&
+      github.event.pull_request.base.ref == 'main' &&
+      github.repository == 'NVIDIA/Megatron-LM'
+    steps:
+      - name: Save PR number
+        run: |
+          mkdir -p pr
+          echo "${{ github.event.pull_request.number }}" > pr/number
+      - name: Upload PR number
+        uses: actions/upload-artifact@v4
+        with:
+          name: pr-number
+          path: pr/