ci: open the release pull request as the app so it gets CI - #2403
ci: open the release pull request as the app so it gets CI#2403alexander-akait wants to merge 2 commits into
Conversation
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2403 +/- ##
==========================================
- Coverage 96.97% 96.91% -0.07%
==========================================
Files 12 12
Lines 1653 1653
==========================================
- Hits 1603 1602 -1
- Misses 50 51 +1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
A pull request opened with the repository's own GITHUB_TOKEN does not trigger workflows, so the release pull request never ran lint, the test matrix or the client job -- #2393 has only the two Socket checks on it, and with no checks reported it cannot be merged. The repository already generates an app token for the dependabot auto-merge workflow; the release job now does the same and hands it to changesets/action. v2 takes a custom token through the github-token input rather than the environment variable, which stays set because changeset version runs the changelog generator against the GitHub API.
90781a7 to
856c4f2
Compare
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 8 included reviews per hour; 6 remain after this review. WalkthroughThe release workflow now generates a GitHub App token from Merge Risk: ⚪ Minimal · up to This localized workflow change updates release pull requests to use the repository app token so required CI workflows can run; no actionable merge-blocking risk remains beyond normal checks and review. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.) ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Team
Run ID: c09d2fb8-3eb8-42c7-a032-918093a29bfe
📒 Files selected for processing (1)
.github/workflows/release.yml
Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.
create-github-app-token mints a token carrying every permission the app is installed with. changesets/action documents needing contents: write to commit the version change and pull-requests: write to open the pull request, so the token now requests those two and nothing else. They match the job's own permissions block; id-token comes from the workflow for trusted publishing and is not a token permission.
|
The diff is a single file, It has now happened on two heads of this branch, so I looked for a nondeterministic line rather than assuming a blip. Both suites are deterministic here:
So the varying hit is not in the tests. CI merges 13 uploads for a head (12 No commit for it, since there is nothing in this diff to fix. Flagging it rather than leaving a red check unexplained: if it persists on unrelated pull requests, the upload composition is worth looking at on its own. Generated by Claude Code |
1 participant
Summary
A pull request opened with the repository's own
GITHUB_TOKENdoes not trigger workflows. That is why #2393 has only the two Socket checks on it and noLint,TestorClientjob at all — the version bump and changelog reachmainwithout the suite ever running on them, and with no checks reported the pull request cannot be merged.The repository already generates an app token for the dependabot auto-merge workflow. The release job now does the same and hands it to
changesets/action, which in v2 takes a custom token through thegithub-tokeninput rather than the environment variable.GITHUB_TOKENstays set inenvbecausechangeset versionruns the changelog generator, which queries the GitHub API for commit and pull request info.Effect on #2393: the next release-workflow run updates that pull request as the app, which triggers the workflows on it. Same secrets as
dependabot.yml(BOT_APP_ID/BOT_PRIVATE_KEY), so nothing new needs configuring.What kind of change does this PR introduce?
ci
Did you add tests for your changes?
No — workflow change; verified by parsing the workflow and checking
github-tokenagainst the pinned action's ownaction.yml.Does this PR introduce a breaking change?
No.
If relevant, what needs to be documented once your changes are merged or what have you already documented?
n/a
Use of AI
AI was used. Claude Code diagnosed why the release pull request had no checks, wrote the workflow change, and drafted this description.
🤖 Generated with Claude Code
https://claude.ai/code/session_01KUpsHWHZG2FxHzJxRUvVv3
Generated by Claude Code
Summary by CodeRabbit