Skip to content

Use GitHub App token in Python versions update workflow - #646

Open
hashhar wants to merge 1 commit into
masterfrom
hashhar/python-versions-app-token
Open

hashhar wants to merge 1 commit into
masterfrom
hashhar/python-versions-app-token

Conversation

@hashhar

@hashhar hashhar commented Oct 2, 2026

Copy link
Copy Markdown
Member

The scheduled run has failed every month since it was added (latest):

! [remote rejected] bot/update-python-versions -> bot/update-python-versions (refusing to allow a GitHub App to create or update workflow `.github/workflows/ci.yml` without `workflows` permission)

GITHUB_TOKEN cannot push changes under .github/workflows/. PRs it opens also do not trigger CI. This switches to the service account GitHub App token, as ok-to-test.yml in trinodb/trino does, and skips the job on forks.

Needs an org admin before merge:

  • Install the service account GitHub App on this repo with Contents, Pull requests and Workflows read/write.
  • Make SERVICE_ACCOUNT_APP_ID and SERVICE_ACCOUNT_PRIVATE_KEY available to this repo. They are currently repo secrets in trinodb/trino only.

GITHUB_TOKEN cannot push changes under .github/workflows/, so every run
failed when the script updated the CI matrix. PRs opened with
GITHUB_TOKEN also do not trigger CI.

The workflow now uses the service account GitHub App token, the same
way trinodb/trino does. It also skips running on forks.
@cla-bot cla-bot Bot added the cla-signed label Oct 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Development

Successfully merging this pull request may close these issues.

1 participant