From 61a704334c8c7ea33d79a67f3075da054ff64728 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Igor=20=C5=A0=C4=87eki=C4=87?= <iscekic@protonmail.com>
Date: Fri, 24 Jul 2026 22:02:37 +0200
Subject: [PATCH] fix(ci): pass KILO_ORG_ID to docs-sync LLM steps (#12519)

Without KILO_ORG_ID the kilo provider sends no X-KiloCode-OrganizationId
header, so the gateway bills the key owner's personal balance instead of
the org. The dry run (run 30107542234) 402'd every triage chunk with
"Add credits to continue, or switch to a free model" and silently
classified 0/187 PRs.

Hoist KILO_API_KEY + KILO_ORG_ID to job-level env, matching smoke-test.yml.
---
 .github/docs-sync/edit.mjs      |  2 +-
 .github/docs-sync/triage.mjs    |  4 ++--
 .github/workflows/docs-sync.yml | 10 +++++-----
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/docs-sync/edit.mjs b/.github/docs-sync/edit.mjs
index 52943de31a..7da66bca64 100644
--- a/.github/docs-sync/edit.mjs
+++ b/.github/docs-sync/edit.mjs
@@ -10,7 +10,7 @@
  * warning — its PRs show up in the rolling PR body as skipped, so nothing
  * fails silently.
  *
- * Env: EDIT_MODEL (provider/model), KILO_API_KEY (set by workflow; read natively by the kilo provider).
+ * Env: EDIT_MODEL (provider/model), KILO_API_KEY + KILO_ORG_ID (set by workflow; read natively by the kilo provider).
  */
 
 import { execFileSync } from "node:child_process"
diff --git a/.github/docs-sync/triage.mjs b/.github/docs-sync/triage.mjs
index 034a7ddcbd..a3a5683116 100644
--- a/.github/docs-sync/triage.mjs
+++ b/.github/docs-sync/triage.mjs
@@ -10,8 +10,8 @@
  * "unclassified" entries (docs_worthy=false) instead of failing the run —
  * the PR body then shows those PRs as skipped, visible to reviewers.
  *
- * Env: TRIAGE_MODEL (provider/model), KILO_API_KEY (gateway auth, set by the workflow;
- * the kilo provider reads it natively). Reads the prompt from triage-prompt.md next to this script.
+ * Env: TRIAGE_MODEL (provider/model), KILO_API_KEY + KILO_ORG_ID (gateway auth, set by
+ * the workflow; the kilo provider reads them natively). Reads the prompt from triage-prompt.md next to this script.
  */
 
 import { execFileSync } from "node:child_process"
diff --git a/.github/workflows/docs-sync.yml b/.github/workflows/docs-sync.yml
index 9eacf14e61..ffc803c17c 100644
--- a/.github/workflows/docs-sync.yml
+++ b/.github/workflows/docs-sync.yml
@@ -41,6 +41,11 @@ jobs:
     if: github.repository == 'Kilo-Org/kilocode'
     runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 120
+    env:
+      # Both are required: without KILO_ORG_ID the gateway bills the key
+      # owner's personal balance (402 "Add credits") instead of the org.
+      KILO_API_KEY: ${{ secrets.KILO_API_KEY }}
+      KILO_ORG_ID: ${{ secrets.KILO_ORG_ID }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -74,8 +79,6 @@ jobs:
       - name: Triage merged PRs (LLM, chunked)
         id: triage
         if: steps.collect.outputs.count != '0'
-        env:
-          KILO_API_KEY: ${{ secrets.KILO_API_KEY }}
         run: node .github/docs-sync/triage.mjs
 
       - name: Filter docs-worthy PRs
@@ -103,8 +106,6 @@ jobs:
 
       - name: Update docs (Kilo CLI, batched)
         if: (steps.worthy.outputs.count || '0') != '0' && inputs.dry_run != true
-        env:
-          KILO_API_KEY: ${{ secrets.KILO_API_KEY }}
         run: node .github/docs-sync/edit.mjs
 
       - name: Verify docs build and tests
@@ -122,7 +123,6 @@ jobs:
         if: steps.verify.outcome == 'failure'
         continue-on-error: true
         env:
-          KILO_API_KEY: ${{ secrets.KILO_API_KEY }}
           NEXT_PUBLIC_POSTHOG_KEY: ${{ secrets.POSTHOG_API_KEY }}
         run: |
           set -o pipefail