ci(automerge): merge as the deploy-bot app - #15
Merged
Merged
Conversation
Standardizes the fleet auto-merge identity on emkraan-deploy-bot; GITHUB_TOKEN stays only as the automatic fallback.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Standardizes this repo's auto-merge identity on the
emkraan-deploy-botGitHub App, the fleet's designated CI deploy and auto-merge identity. The caller now passes the org-levelDEPLOY_APP_ID/DEPLOY_APP_PRIVATE_KEYto the reusable workflow.Why
Choosing the identity per repo was error-prone: muninn had push-triggered deploys but merged as
GITHUB_TOKEN, which never fires push workflows. One identity everywhere removes that choice. Merges now trigger push workflows (for example post-merge validation), and GitHub closes linked issues natively. The org secret is already visible to every repo, so this adds no new exposure. Fork-PR runs never receive secrets, and the reusable workflow never checks out PR code.GITHUB_TOKENremains only as the automatic per-run fallback, for PRs that change workflow files (the App deliberately has noworkflows: write) and for reading check results.Standard: Apollo
docs/standards/github-repo-standard.mdSection 8.