Repository navigation
ci: fall back to github.token in the AI policy workflow - #349
Conversation
Secrets are not exposed to pull requests from forks, so COMMAND_BOT_PAT is
empty there and the first step fails before it checks anything:
gh: To use GitHub CLI in a GitHub Actions workflow, set the GH_TOKEN
environment variable.
Process completed with exit code 4
check-ai-trailers therefore fails on every PR from a fork, regardless of its
commits. The workflow already requests the permissions it needs, so the default
token can read the commit list.
This is what the organization template in nextcloud/.github already does, and
what nextcloud/spreed carries; this copy predates that change.
Signed-off-by: Baki Burak Öğün <63836730+bakiburakogun@users.noreply.github.com>
kyteinsky
left a comment
kyteinsky
left a comment
There was a problem hiding this comment.
nice thanks!
although your PRs should have this trailer too :)
|
Hello there, We hope that the review process is going smooth and is helpful for you. We want to ensure your pull request is reviewed to your satisfaction. If you have a moment, our community management team would very much appreciate your feedback on your experience with this PR review process. Your feedback is valuable to us as we continuously strive to improve our community developer experience. Please take a moment to complete our short survey by clicking on the following link: https://cloud.nextcloud.com/apps/forms/s/i9Ago4EQRZ7TWxjfmeEpPkf6 Thank you for contributing to Nextcloud and we hope to hear from you soon! (If you believe you should not receive this message, you can add yourself to the blocklist.) |
2 participants
Problem
check-ai-trailersfails on every pull request from a fork, whatever the commits contain. The first step never gets as far as inspecting them:Secrets are not exposed to
pull_requestruns from forks, sosecrets.COMMAND_BOT_PATis empty andgh apiexits 4.Change
Fall back to
github.token, which is what the organization template in nextcloud/.github already does:nextcloud/spreedalready carries the updated version; this copy predates it. The workflow declares the permissions it needs (contents: read,pull-requests: write,issues: write), so the default token can read the commit list.Noticed because it is the only red check on #343.