From b7dc7448574ac97361b19878681cfcf2cbaaa87b Mon Sep 17 00:00:00 2001 From: Tom Riglar Date: Mon, 12 Oct 2026 13:40:40 +0100 Subject: [PATCH] ci: push bot commits with a GitHub App token GitHub does not accept GitHub Actions as a ruleset bypass actor, so a GITHUB_TOKEN push cannot get past a "require pull request" rule. Mint a short-lived devicecloud-push-bot token (contents: write only) and push with it; that app is a bypass actor on this repo's rulesets. Falls back to GITHUB_TOKEN while PUSH_APP_ID / PUSH_APP_PRIVATE_KEY are unset. Bot commits now carry the skip-ci marker in their message body: app-token pushes start workflows, GITHUB_TOKEN pushes never did. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/build-source.yaml | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-source.yaml b/.github/workflows/build-source.yaml index ba3e2af..0bbc9cb 100644 --- a/.github/workflows/build-source.yaml +++ b/.github/workflows/build-source.yaml @@ -17,7 +17,21 @@ jobs: runs-on: ubuntu-latest permissions: contents: write + env: + PUSH_APP_ID: ${{ secrets.PUSH_APP_ID }} steps: + - name: Mint push token + # devicecloud-push-bot (contents: write only) is a bypass actor on this repo's + # rulesets, so it can push to the protected branch; GitHub Actions can't be one. + # Falls back to GITHUB_TOKEN while PUSH_APP_ID / PUSH_APP_PRIVATE_KEY are unset. + id: push-token + if: env.PUSH_APP_ID != '' + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + app-id: ${{ secrets.PUSH_APP_ID }} + private-key: ${{ secrets.PUSH_APP_PRIVATE_KEY }} + permission-contents: write + - name: Checkout Repository uses: actions/checkout@v7 with: @@ -46,10 +60,12 @@ jobs: continue-on-error: true run: | git add dist/index.js -f - git commit -m "[CI] Add changes" + # [skip ci]: app-token pushes start workflows (GITHUB_TOKEN pushes + # never did). This keeps it that way. + git commit -m "[CI] Add changes" -m "[skip ci]" - name: Push changes uses: ad-m/github-push-action@v1.3.0 with: - github_token: ${{ secrets.GITHUB_TOKEN }} + github_token: ${{ steps.push-token.outputs.token || secrets.GITHUB_TOKEN }} branch: main