The publication run proposes the catalogue as a GitHub App, so its request gets its checks (#167) - #172
Merged
Conversation
…quest gets its checks (#167) A request opened with the run's own token triggers no workflow, which GitHub states with workflow_dispatch and repository_dispatch as the only exceptions, so every catalogue request stayed BLOCKED until a hand closed and reopened it. The run now mints a token from the publisher App installed on this repository alone, with contents and pull requests and nothing else, and reads, writes and proposes with it; the job keeps only the read the checkout needs. The DCO gate skips commits authored by any GitHub App, as it skipped Dependabot and the run itself, because a bot cannot certify the certificate and the publisher now commits as one. Signed-off-by: Nils Lehnen <nils.lehnen@proton.me>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
For #167. The daily publication run opens the catalogue pull request with its own token, and GitHub creates no workflow runs for events made with that token, so the nineteen required checks never arrived and a hand closed and reopened every such request.
What changes
publish.ymlmints a token from the publisher App (installed on this repository alone,contents: writeandpull_requests: write, key and id as Actions secrets) with the pinnedactions/create-github-app-tokenand hands it togo run . publish carry. The job's own permissions shrink to the read the checkout needs.dco.ymlskips commits authored by any GitHub App (*[bot]@users.noreply.github.com), as it skipped Dependabot and the run itself: a bot cannot certify the DCO, and the publisher now commits as one.Why an App and not dispatchable workflows
Making the six gate workflows dispatchable would ask
dco.ymlanddependency-reviewto take their subject from an input rather than from the pull request, which widens where a green on those contexts can come from, and would have to be repeated for every workflow the ruleset adds. The App is the route GitHub documents for this case, and the ruleset does not change.Verification
run: go run . publish carryin the file, and the concurrency group is untouched.Signed-off-by: Nils Lehnen nils.lehnen@proton.me