Use docs-bot app token for generated changelog and CLI doc PRs#1537
Open
justinegeffen wants to merge 2 commits into
Open
Use docs-bot app token for generated changelog and CLI doc PRs#1537justinegeffen wants to merge 2 commits into
justinegeffen wants to merge 2 commits into
Conversation
PRs created with secrets.GITHUB_TOKEN are authored by github-actions[bot], and GitHub deliberately does not trigger downstream workflows from those — to prevent recursion. Net effect: changelog PRs from changelog-from-releases.yml and CLI doc PRs from update-cli-docs.yml were landing without check-internal-links, pre-commit-check, or no-conflict-markers ever running on them. Switch both workflows to the same docs-bot GitHub App token already used by update-permissions-docs.yml and update-audit-events-docs.yml. Now generated PRs are opened by the bot user and downstream CI runs as expected. - Add a "Generate docs app token" step that wraps actions/create-github-app-token with DOCS_BOT_APP_ID / DOCS_BOT_APP_PRIVATE_KEY (already configured in repo secrets). - Use the token on actions/checkout so `git push` inside generate-changelog.py is authenticated as the bot. - Pass the token to gh / peter-evans/create-pull-request for the PR itself. - Tighten the changelog workflow's top-level permissions block now that it no longer needs write scopes on GITHUB_TOKEN. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
✅ Deploy Preview for seqera-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Signed-off-by: Justine Geffen <justinegeffen@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Brings changelog-from-releases.yml and update-cli-docs.yml in line with the cross-repo content pipelines so generated PRs trigger downstream CI.
Problem
PRs created with
secrets.GITHUB_TOKENare authored bygithub-actions[bot]. GitHub deliberately does not fire downstream workflows from PRs opened bygithub-actions[bot](it's the anti-recursion guard for cases where a workflow that writes also triggers itself). Net effect: every changelog PR and CLI doc PR landed withoutcheck-internal-links,pre-commit-check, orno-conflict-markersever running on it.The Platform → docs dispatch flows (update-permissions-docs.yml, update-audit-events-docs.yml) already use the docs-bot GitHub App token and don't have this problem. This PR extends the same pattern to the other two.
Changes
Generate docs app tokenstep (usingactions/create-github-app-token@v3.0.0, same SHA used in the four existing workflows) wrappingDOCS_BOT_APP_ID/DOCS_BOT_APP_PRIVATE_KEY.actions/checkoutsogit pushinsidegenerate-changelog.pyauthenticates as the bot, and togh pr create/peter-evans/create-pull-requestso the PR itself is opened by the bot.changelog-from-releases.ymltop-levelpermissions:— it no longer needscontents: write/pull-requests: writeonGITHUB_TOKENsince the bot token handles both.No secret changes required
DOCS_BOT_APP_IDandDOCS_BOT_APP_PRIVATE_KEYare already configured for the permissions and audit-events workflows. The docs-bot GitHub App is already installed on this repo with contents + pull request write.Test plan
Changelogsworkflow againstseqeralabs/wavewith a single release tag. Confirm the generated PR is authored by the docs-bot user and thatcheck-internal-links,pre-commit-check, etc. fire on it.Update CLI Documentationagainst a tower-cli release. Confirm the generated PR triggers downstream CI.🤖 Generated with Claude Code