Repository navigation
fix(release): open the Version Packages PR with the repobuddy App token (v2 line) - #61
Merged
Merged
Conversation
A PR opened with GITHUB_TOKEN does not trigger `on: pull_request` workflows, so the Version Packages PR gets no checks and needs an admin bypass to merge. The changesets workflows that used GITHUB_TOKEN now accept optional RELEASE_APP_ID and RELEASE_APP_PRIVATE_KEY secrets, mint an app token when both are set, and hand it to checkout and changesets/action. Without them they fall back to the built-in token, as before. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: unional <homawong@gmail.com>
|
|
This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again. |
unional
added a commit
that referenced
this pull request
Oct 11, 2026
…cret (v2 line) (#63) * fix(release): start CI on the Version Packages PR without a stored secret (v2 line) Replace the optional GitHub App token from #61 with a secretless dispatch. GITHUB_TOKEN-caused events start no workflows, so the version PR got no checks and stayed blocked on the required `code / all-checks`. workflow_dispatch is the one event GITHUB_TOKEN may trigger, so after changesets/action opens or updates the PR, the release job runs `gh workflow run <ci-workflow> --ref changeset-release/<branch>`. - Remove RELEASE_APP_ID / RELEASE_APP_PRIVATE_KEY, HAS_RELEASE_APP, the create-github-app-token step and the token fallbacks. - Update the README caller example and adoption steps. - Add a `ci-workflow` input (default pull-request.yml) and document `actions: write`; callers must grant it and add `workflow_dispatch:` to their CI workflow. A failed dispatch warns, never fails the release. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: unional <homawong@gmail.com> * fix(release): do not declare actions: write in the reusable workflow A called workflow cannot request a permission its caller did not grant; the run fails at startup. Existing callers grant only id-token, contents and pull-requests, so declaring actions: write would break every release. The dispatch stays fail-soft: without the caller grant it 403s and warns, now with a message that names the missing actions: write grant. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: unional <homawong@gmail.com> --------- Signed-off-by: unional <homawong@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
A changesets "Version Packages" PR opened with the built-in
GITHUB_TOKENdoes not triggeron: pull_requestworkflows. It gets no checks and can only be merged with an admin bypass.What
The v2-line counterpart of #60. Ports the pattern from
clibuilder/.github'spnpm-release-changeset.yml(whose Version PRs are authored byapp/repobuddy) to:pnpm-release-changeset-oidc.yml: optionalRELEASE_APP_ID/RELEASE_APP_PRIVATE_KEYsecrets, anactions/create-github-app-token@v3step gated on both, and the token passed toactions/checkout(token:) and tochangesets/action@v2.0.0(github-token:), each falling back to the built-in token. v2 ignores theGITHUB_TOKENenv var, so thegithub-tokeninput is what carries it; the env line is kept and points at the same token.README.md: both caller examples gain the twosecrets:lines, and the trade-off note is rewritten. Consumers whosepull-request.ymlcarriesbranches-ignore: ['changeset-release/*']still skip checks on the Version PR until they drop that filter.The changesets/action version, its inputs, and the npm OIDC steps are unchanged.
pnpm-release-changeset.ymluses theCI_GITHUB_TOKENPAT, which already triggers checks, so it is not changed.Validated with actionlint 1.7.7.
🤖 Generated with Claude Code