ci: mint a bee-runner App token instead of the dead GHA_PAT_ADVANCED - #843
Merged
Conversation
✅ Deploy Preview for test-twitter-preview-testing-3 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
update-openapiworkflow has been failing on every scheduled run since August 27. The problem is not a missing secret.GHA_PAT_ADVANCEDis an organization-level secret that has been shared with this repo since #826. But the token in it is dead. GitHub returns401 Bad credentials. The same secret fails inethersphere/gateway-proxytoo, which means the token itself is broken, not this repo's setup.The problem stayed hidden for seven weeks. After #826 switched the workflow over, every scheduled run skipped the "Create or update PR" step because the docs were already up to date. The new token was never used. Bee v2.8.2 came out on August 26. The run on August 27 was the first to reach that step, and it failed. No openapi auto-update PR has been opened since #826 merged.
This PR uses a short-lived
bee-runnerGitHub App token instead. It only works on this repo and has write access to contents and pull-requests. This matches the pattern used inethersphere/swarm-cli. It also updatespeter-evans/create-pull-requestfrom v6 to v8.1.1, since v6 runs on the old Node 20.The token also asks for
issues: write. That looks odd for a docs bot, so to explain: PR labels are applied through the issues API, andtag-on-openapi-merge.yamlonly runs when theopenapi-auto-updatelabel is present. Without that permission the label would not be applied and the tagging workflow would never fire.tag-on-openapi-merge.yamlis fixed in the same PR. It still usedBOT_PAT, which no longer exists at repo or org level. That workflow only runs when an openapi PR merges, so the break is invisible now. But it would fail as soon as this one starts working again.Auto-PRs will now be made by
bee-runner[bot]instead ofbee-worker.GHA_PAT_ADVANCEDis left alone here. gateway-proxy needs to fix or move it separately.