Repository navigation
Conversation
…GitHub App A PAT pushes as its owner and needs a workflow grant renewed by hand; an org App token is minted per run and names the automation as the author. Tested: actionlint on both workflows, shellcheck and --self-test of bump-consumers.sh, tests/self-tests.sh Cost: n/a (no measured figure in this cloud session) Co-Authored-By: Claude <noreply@anthropic.com>
github-actions
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Before:
bump consumerspushes with the PAT behindMAROLA_CROSS_REPO_PAT. Its commits are attributed to github-actions[bot] and its PRs to whoever owns the token. Every consumer push was rejected because the token has no workflow permission.After: the workflow mints a short-lived token for the org's GitHub App
marola-bot(actions/create-github-app-token), and the commits and PRs are authored bymarola-bot[bot]. No personal token is involved, so nothing expires.How:
bump-consumers.ymlreads the org variableMAROLA_BOT_APP_IDand the org secretMAROLA_BOT_PRIVATE_KEY. It looks up the bot's user id to build the commit email and passes the name and email tobump-consumers.sh(BUMP_GIT_NAME/BUMP_GIT_EMAIL, defaulting to github-actions[bot]).release.ymlpasses the key through.docs/3-development.mdgives the one-time App setup.Part of #47.
Generated by Claude Code