Skip to content

ci: nightly prs open as a github app, against the newest rc branch - #34

Merged
IsuraManchanayake merged 2 commits into
mainfrom
fix/nightly-app-token
Oct 26, 2026
Merged

IsuraManchanayake merged 2 commits into
mainfrom
fix/nightly-app-token

Conversation

@IsuraManchanayake

@IsuraManchanayake IsuraManchanayake commented Oct 26, 2026 •

Copy link
Copy Markdown
Collaborator

Every nightly since 10-22 has passed its tests and then failed in the record jobs: gh pr create returns GitHub Actions is not permitted to create or approve pull requests, because this repository has that setting off. Turning it on would not be enough. A PR or push made with GITHUB_TOKEN starts no workflow, so the four checks main requires would never run on the nightly's PRs.

A GitHub App writes the records. record-llamacpp and record-mlx now:

  • mint a token for the nightly's App (vars.NIGHTLY_APP_ID, secrets.NIGHTLY_APP_PRIVATE_KEY, both set) with actions/create-github-app-token@v2
  • check out with it, so the force-push to nightly/<runtime> is the App's and CI runs on the PR
  • give it to gh for the PR and issue steps
  • keep the job's own token at contents: read, which nightly_runtimes.py llamacpp append still uses to read the build's digests

The PRs go to the release being cut. pick finds the newest rc-X.Y.Z branch by version (rc-0.1.10 after rc-0.1.9), else main, and outputs it as base. Every job checks base out:

  • the adapter is tested on that branch's code
  • pick and append read and change that branch's recipe

So the claim "tested with X" holds for the branch it lands on. Against main the PRs open as drafts. When an open PR's branch changes, the record job rebuilds nightly/<runtime> on the new one, retargets the PR, and moves it into or out of draft to match:

  • an rc is cut while a draft against main is open: the PR moves to the rc, ready for review
  • no rc is open while a PR against an old rc is still open: it moves to main as a draft

A workflow_dispatch from another branch now only changes which workflow file runs. The code it tests is still base's.

To check once merged, run gh workflow run nightly-runtimes.yml --ref main. With rc-0.1.5 open, the PRs from nightly/llamacpp and nightly/mlx should target it, be opened by the App's bot, and get CI on their own.

The repository does not let Actions open pull requests, so every record job
since 10-22 failed at `gh pr create` after pushing its branch. A PR or push
made with GITHUB_TOKEN would also start no workflow, leaving the checks main
requires unrun. The record jobs now push, open PRs and write issues with a
token of the nightly's GitHub App (vars.NIGHTLY_APP_ID,
secrets.NIGHTLY_APP_PRIVATE_KEY); their own token drops to contents: read.
`pick` finds the newest rc-X.Y.Z branch by version, or main when no release
is being cut. Every job checks it out, so the adapter is tested and the
recipe read and changed as that branch has them. Against main the PRs open
as drafts. An open PR whose branch changed is rebuilt on the new one,
retargeted, and moved into or out of draft to match.
@IsuraManchanayake IsuraManchanayake changed the title ci: nightly records write with a github app token ci: nightly prs open as a github app, against the newest rc branch Oct 26, 2026
@IsuraManchanayake
IsuraManchanayake merged commit bd8a03e into main Oct 26, 2026
4 checks passed
@IsuraManchanayake
IsuraManchanayake deleted the fix/nightly-app-token branch October 26, 2026 03:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant