fix(generate-changelog): push the changelog branch with the app token - #94
Merged
Merged
Conversation
create-pr pushes with the credentials of the checkout, which used the default token. With reuse_branch, those force pushes update an open pull request as github-actions[bot]: pull_request_target workflows don't run, so required workflows never report, and pull_request workflows wait for approval where external contributors need it.
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
No unresolved issues were identified.
Review effort: Lite
Findings: None
What changed in this PR
Updates changelog automation to push reused branches with the GitHub App token, ensuring downstream workflows trigger correctly.
Changes:
- Documents matching tokens for checkout and
create-pr. - Configures changelog checkout with the App token.
| File | Description |
|---|---|
actions/create-pr/README.md |
Documents token requirements and updates the example. |
.github/workflows/generate-changelog.yaml |
Uses the App token for checkout and pushes. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
lwshang
approved these changes
Sep 25, 2026
This was referenced Sep 25, 2026
sea-snake
pushed a commit
to dfinity/icp-js-auth
that referenced
this pull request
Sep 25, 2026
Picks up dfinity/ci-tools#94. `bdfe993..a98f5d0` is only that commit. Since `reuse_branch` (dfinity/ci-tools#80), the changelog pull request is force pushed on every push to `main`, and those pushes came from the default token as `github-actions[bot]`. Its workflows then waited for approval, and required `pull_request_target` workflows such as the External PR Ruleset never ran, which blocks the pull request even when approved (e.g. dfinity/pic-js#290). With #94, the branch is pushed with the app token instead. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
marc0olo
added a commit
to dfinity/icp-js-bindgen
that referenced
this pull request
Sep 25, 2026
Picks up dfinity/ci-tools#94. `bdfe993..a98f5d0` is only that commit. Since `reuse_branch` (dfinity/ci-tools#80), the changelog pull request is force pushed on every push to `main`, and those pushes came from the default token as `github-actions[bot]`. Its workflows then waited for approval, and required `pull_request_target` workflows such as the External PR Ruleset never ran, which blocks the pull request even when approved (e.g. dfinity/pic-js#290). With #94, the branch is pushed with the app token instead. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
marc0olo
added a commit
to dfinity/icp-js-sdk-docs
that referenced
this pull request
Sep 25, 2026
Picks up dfinity/ci-tools#94. `bdfe993..a98f5d0` is only that commit. Since `reuse_branch` (dfinity/ci-tools#80), the changelog pull request is force pushed on every push to `main`, and those pushes came from the default token as `github-actions[bot]`. Its workflows then waited for approval, and required `pull_request_target` workflows such as the External PR Ruleset never ran, which blocks the pull request even when approved (e.g. dfinity/pic-js#290). With #94, the branch is pushed with the app token instead. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
sea-snake
pushed a commit
to dfinity/icp-js-signer
that referenced
this pull request
Sep 25, 2026
Picks up dfinity/ci-tools#94. `bdfe993..a98f5d0` is only that commit. Since `reuse_branch` (dfinity/ci-tools#80), the changelog pull request is force pushed on every push to `main`, and those pushes came from the default token as `github-actions[bot]`. Its workflows then waited for approval, and required `pull_request_target` workflows such as the External PR Ruleset never ran, which blocks the pull request even when approved (e.g. dfinity/pic-js#290). With #94, the branch is pushed with the app token instead. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
marc0olo
added a commit
to dfinity/icp-js-core
that referenced
this pull request
Sep 25, 2026
Picks up dfinity/ci-tools#94. `bdfe993..a98f5d0` is only that commit. Since `reuse_branch` (dfinity/ci-tools#80), the changelog pull request is force pushed on every push to `main`, and those pushes came from the default token as `github-actions[bot]`. Its workflows then waited for approval, and required `pull_request_target` workflows such as the External PR Ruleset never ran, which blocks the pull request even when approved (e.g. dfinity/pic-js#290). With #94, the branch is pushed with the app token instead. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Since
reuse_branch(#80), the changelog pull request of repositories using this workflow gets stuck after its first update, e.g. dfinity/pic-js#290.Problem
create-prpushes the branch with the git credentials ofactions/checkout, which used the default token. Before #80, every run pushed a new branch and then opened the pull request with the app token, so the pull request's workflows were triggered by the app'sopenedevent. Withreuse_branch, every run force pushes the branch of the pull request that is already open. Each update is then asynchronizeevent fromgithub-actions[bot]:pull_request_targetworkflows don't run, as GitHub doesn't trigger workflows for events caused by the default token. Required workflows such as the org's External PR Ruleset never report, so the pull request stays blocked even when approved.pull_requestworkflows wait for approval in repositories that require it for external contributors, asgithub-actions[bot]counts as one.On dfinity/pic-js#290, every force push since #80 is by
github-actions[bot], with runs inaction_requiredand no External PR Ruleset run. Pull requests without such an update, like dfinity/icp-js-core#1400 or the release pull request dfinity/pic-js#280, ran every workflow aspr-automation-bot-public[bot].Fix
Check out with the app token, which
create-prthen pushes with. The token is already created before the checkout. Thecreate-prREADME now says to pass the token toactions/checkouttoo, and its example does.🤖 Generated with Claude Code