Repository navigation
ci(weekly): open the downloads pull request with a personal access token - #461
Conversation
A push or pull request made with `GITHUB_TOKEN` leaves the pull request's `pull_request` workflows waiting for maintainer approval, so the weekly downloads pull request never reports its required checks on its own. Mint a GitHub App installation token for the push and the pull request instead, and drop the workflow's own `GITHUB_TOKEN` to read-only. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014fc28pKY9wf4DFssSzoNRN
|
This is not caused by the diff. Cloudflare's build list for the Separately, both live Workers Builds triggers leave out Generated by Claude Code |
Replace the GitHub App token with an `AUTOMATION_TOKEN` fine-grained personal access token, so the setup is a single repository secret. It still keeps pushes and the pull request off `GITHUB_TOKEN`, so the weekly pull request's checks run without approval. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014fc28pKY9wf4DFssSzoNRN
joe-bell
changed the title
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
cva | 627b74a | Commit Preview URL Branch Preview URL |
Oct 16 2026, 10:08 AM |
Match the name the secret was created under in the repository settings. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014fc28pKY9wf4DFssSzoNRN
|
@codex review Generated by Claude Code |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 56bd88c7e7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
A repository secret is readable by any branch: a write-access user can dispatch the workflow from a branch whose copy prints the token, and the token acts as the owner, who bypasses the default-branch ruleset. Run the job in the `weekly-automation` environment so the token is only released to `main`. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014fc28pKY9wf4DFssSzoNRN
|
@codex review Generated by Claude Code |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 627b74a855
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Merging `main` into the update branch made the token push a merge commit that carries `main`'s workflow-file changes, which a token without the Workflows permission cannot write. Checking that unprotected branch out also ran whatever a collaborator pushed to it, hooks included, while the token was exposed. Rebuild the branch from `origin/main` plus the snapshot commit on every run and force-push it with a lease, skip the push when the remote already matches, and unset `core.hooksPath` before using the token. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014fc28pKY9wf4DFssSzoNRN
|
@codex review Generated by Claude Code |
|
Codex Review: Didn't find any major issues. 🚀 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Requested by Joe · project thread
Description
Before: the weekly npm downloads pull request (for example #459) shows "2 workflows awaiting approval", and every required check sits at "Waiting for status to be reported" until a maintainer approves the
ciandcloudflareruns by hand.After: the weekly pull request's checks start on their own, the same as any other pull request.
weekly / npm-downloadspushed the snapshot and opened the pull request withGITHUB_TOKEN, sogithub-actions[bot]triggered the pull request'spull_requestworkflows. GitHub records those runs asaction_required(both runs on #459 show that conclusion) rather than starting them, and no repository setting lifts that.How: the push and
gh pr createnow useWEEKLY_AUTOMATION_TOKEN, a fine-grained personal access token, instead ofGITHUB_TOKEN. That token acts as the owner, who bypasses the default-branch ruleset, so it is kept away from untrusted code:weekly-automationenvironment that onlymainmay deploy to. A run dispatched from another branch, or a new workflow added on one, can't read the token.core.hooksPathbefore using the token, and it never checks out the unprotected update branch. Each run rebuildsautomation/weekly-npm-downloadsasorigin/mainplus one snapshot commit and force-pushes it with a lease. The run skips the push when the remote already matches.mainhas gained workflow changes. The old merge ofmaininto the branch would have needed it.Commits keep the
github-actions[bot]author. The workflow's ownGITHUB_TOKENdrops tocontents: read.Additional context
This needs repository configuration before merging, or the next weekly run fails:
joe-bell/cvaonly, and repository permissions Contents: Read and write and Pull requests: Read and write.weekly-automation, and set its deployment branches to the selected branchmainonly.WEEKLY_AUTOMATION_TOKEN, and delete any repository-level secret with the same name.The token expires on the date chosen at creation, so it needs renewing. Pull requests the workflow opens will list the token's owner as author.
After merging, running the workflow manually from
mainrebuildsautomation/weekly-npm-downloadswith the token, which starts the checks on #459 without an approval. The workflow only runs frommainon a schedule or dispatch, so this PR's CI cannot exercise it. I tested the new push logic against a local remote instead: an existing branch behind a workflow change onmain, an identical re-run that skips the push, and a deleted branch.This changes CI only, not
packages/cva, so the beta What's New page is unaffected.What is the purpose of this pull request?
Before submitting the PR, please make sure you do the following
fixes #123).🤖 Generated with Claude Code
https://claude.ai/code/session_014fc28pKY9wf4DFssSzoNRN