Repository navigation
ci(release): open the Homebrew formula PR with a GitHub App token - #813
Merged
Merged
Conversation
GitHub holds the pull_request runs of a PR opened with GITHUB_TOKEN until someone with write access approves them, and the dispatched ci.yml run does not report the PR's required checks. Pushing the branch and opening the PR with a GitHub App installation token makes the pull_request workflow run normally, so the job no longer dispatches ci.yml or needs actions: write.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Use client-id, which accepts the App ID and is not deprecated. The action already scopes the token to the current repository, so the owner and repositories inputs and the job-level permissions are redundant. Author the formula commit as the App so the commit and PR share its identity.
hakula139
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GitHub holds the
pull_requestruns of a PR opened withGITHUB_TOKENuntil someone with write access approves them, and the dispatchedci.ymlrun does not report the PR's required checks. This opens the Homebrew formula PR with a GitHub App token instead.hakula-release-botis installed on this repository with Contents and Pull requests write, andRELEASE_APP_IDandRELEASE_APP_PRIVATE_KEYare repository secrets.actions/create-github-app-token@v3and uses it for the checkout andgh pr create, so its push starts the CI and Homebrew Formula workflows and the PR belongs to the App.contents,issues, andpull-requestswrite because the App performs every write, and inherits the workflow-levelcontents: read.ci.ymlor needsactions: write.RELEASING.mdnow merges the formula PR like any other PR.Closes #364
Test plan
nix develop .#lint -c pnpm format: passnix develop .#lint -c pnpm lint: passnix develop .#lint -c pnpm spellcheck: passnix shell nixpkgs#actionlint nixpkgs#shellcheck -c actionlint: pass, except for two false positives from actionlint 1.7.12's embedded metadata forcreate-github-app-token@v3, which predates theclient-idrename. A scratch workflow pinned tov3.3.0passes, and so does this workflow with those two errors ignored.Homebrew Formulacheck runs on this PR because it changesrelease.yml.