Repository navigation
ci: open the nightly and release PRs with a GitHub App token - #112
Merged
Merged
Conversation
Pin checkout, setup-node and create-pull-request to release SHAs, set persist-credentials: false on every checkout, and give every workflow top-level permissions. Add zizmor with adhoc-packages off, since .npmrc sets package-lock=false. Remove the four NPM_TOKEN publish workflows; release.yml publishes over trusted publishing.
Runs on a PR opened with GITHUB_TOKEN wait for manual approval, and GitHub Actions can't create PRs at all with the repo's PR toggle off. The nightly job and release.yml's pr job now mint a token from the app in CI_APP_CLIENT_ID and CI_APP_PRIVATE_KEY, so their PRs get CI right away, and their own GITHUB_TOKEN drops to read or nothing.
# Conflicts: # .github/workflows/nightly-static-build.yaml
Draft
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #109.
Runs on a PR opened with GITHUB_TOKEN wait until someone clicks Approve workflows to run, which is why the nightly data PR (#105) has had approval-pending runs since 2026-10-21. And with the repo's "Allow GitHub Actions to create and approve pull requests" setting off, Actions can't open the PR at all (failed nightly). An app token avoids both.
Changed
contents: read.prjob does the same for uppt/pr, which uses that token for checkout, push and the PR API. The job's own GITHUB_TOKEN gets no permissions.Needs before merge: a GitHub App with Contents and Pull requests read and write, installed on this repo, with its client ID in the
CI_APP_CLIENT_IDvariable and a private key in theCI_APP_PRIVATE_KEYsecret.