Skip to content

Push the helm-docs README commit with a comet-ci App token - #41

Closed
GuySaar8 wants to merge 1 commit into
mainfrom
GuySaar8/DND-1897-github-app-token
Closed

GuySaar8 wants to merge 1 commit into
mainfrom
GuySaar8/DND-1897-github-app-token

Conversation

@GuySaar8

@GuySaar8 GuySaar8 commented Oct 21, 2026 •

Copy link
Copy Markdown
Contributor

Draft. Two org-admin steps before merging:

  1. Give this repo access to the org secret COMET_CI_APP_PRIVATE_KEY and the org variable COMET_CI_APP_CLIENT_ID (they're limited to selected repos).
  2. Add the comet-ci GitHub App as a bypass actor (Always allow) on the ruleset that protects main.

Without step 2, update-readme fails at the push when the README changed.

Summary

update-readme regenerates the README with helm-docs and pushes it straight to main. The ruleset on main only allows that for bypass actors, which is why it used the org PAT (GH_PAT_TO_ACCESS_GITHUB_API). The push now uses a short-lived comet-ci App token minted just before it, limited to this repo with contents: write.

release (chart-releaser to GHCR) is unchanged and keeps using GITHUB_TOKEN.

Test plan

  • Workflow YAML parses, and no workflow references GH_PAT_TO_ACCESS_GITHUB_API any more
  • After the admin steps: the next chart change on main runs update-readme (README pushed if it changed) and release

🤖 Generated with Claude Code

@GuySaar8
GuySaar8 requested a review from CRThaze October 21, 2026 20:38
@github-actions

This comment has been minimized.

@GuySaar8
GuySaar8 force-pushed the GuySaar8/DND-1897-github-app-token branch 2 times, most recently from 9f57dbd to fbfc0b7 Compare October 21, 2026 20:45
@GuySaar8 GuySaar8 changed the title [DND-1897] Push the helm-docs README commit with a comet-ci App token Push the helm-docs README commit with a comet-ci App token Oct 21, 2026
@github-actions

This comment has been minimized.

update-readme pushes the regenerated README straight to main, which the
ruleset on main only allows for bypass actors, so it used the org
PAT. Use a short-lived comet-ci App token limited to this repo
(contents: write) instead. The chart release keeps using GITHUB_TOKEN.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@GuySaar8
GuySaar8 force-pushed the GuySaar8/DND-1897-github-app-token branch from fbfc0b7 to a78685e Compare October 21, 2026 20:46
@github-actions

Copy link
Copy Markdown

📊 Helm Render Diff Summary

Chart charts/s3proxy rendered with Kubernetes 1.29.0. Informational only — this check never fails the PR.

Values File Chart Path Changes Status
test-values/auth-existing-secret.yaml charts/s3proxy - ✅ No Changes
test-values/autoscaling.yaml charts/s3proxy - ✅ No Changes
test-values/azureblob-existing-secret.yaml charts/s3proxy - ✅ No Changes
test-values/azureblob-managed-identity.yaml charts/s3proxy - ✅ No Changes
test-values/azureblob.yaml charts/s3proxy - ✅ No Changes
test-values/b2.yaml charts/s3proxy - ✅ No Changes
test-values/filesystem.yaml charts/s3proxy - ✅ No Changes
test-values/gcs.yaml charts/s3proxy - ✅ No Changes
test-values/ingress.yaml charts/s3proxy - ✅ No Changes
test-values/multi-backend.yaml charts/s3proxy - ✅ No Changes
test-values/openstack-swift.yaml charts/s3proxy - ✅ No Changes
test-values/rackspace.yaml charts/s3proxy - ✅ No Changes
test-values/s3.yaml charts/s3proxy - ✅ No Changes
test-values/tls-existing-secret.yaml charts/s3proxy - ✅ No Changes
test-values/tls.yaml charts/s3proxy - ✅ No Changes
test-values/transient.yaml charts/s3proxy - ✅ No Changes

🎉 No changes detected in any of the tested configurations!

@GuySaar8 GuySaar8 closed this Oct 21, 2026
@GuySaar8
GuySaar8 deleted the GuySaar8/DND-1897-github-app-token branch October 21, 2026 20:46
@GuySaar8

Copy link
Copy Markdown
Contributor Author

Replaced by #42 (same change, renamed branch).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant