From f459d00954181fb4180dd864410406f57ef8f11f Mon Sep 17 00:00:00 2001 From: Weathercold Date: Thu, 4 Jun 2026 06:12:51 -0400 Subject: [PATCH] chore(ci): use personal access token for hash update (#1925) ## Description Unfortunately the method of manually calling CI on the PR branch used by #1907 doesn't count as status check of that PR (#1924), probably because the called workflow inherits the context of the calling workflow, which is not triggered by the PR. I read the docs and the most straightforward solution is using a PAT, which does trigger the pull_request event. Alternatively you can open PR with a custom github app, which is more complicated but allows the app to bypass ruleset and commit directly to main. Or just disable mandatory status checks. ## Linked Issues ## Additional Context --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Rin --- .github/workflows/ci.yml | 15 --------------- .github/workflows/update-nix-assets-hash.yaml | 15 ++++----------- .github/workflows/update-nix-pnpm-deps-hash.yaml | 15 ++++----------- 3 files changed, 8 insertions(+), 37 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 88d90417a..8afb2721b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -10,20 +10,12 @@ on: workflow_dispatch: - workflow_call: - inputs: - ref: - required: true - type: string - jobs: lint: name: Lint runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 - with: - ref: ${{ inputs.ref || github.ref }} - uses: pnpm/action-setup@v5 - uses: actions/setup-node@v6 with: @@ -73,8 +65,6 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 - with: - ref: ${{ inputs.ref || github.ref }} # Turborepo - name: Cache turbo build setup @@ -124,8 +114,6 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 - with: - ref: ${{ inputs.ref || github.ref }} # Turborepo - name: Cache turbo build setup @@ -171,8 +159,6 @@ jobs: if: ${{ !(github.event_name == 'pull_request' && startsWith(github.event.pull_request.head.label, 'moeru-ai:i18n/')) }} steps: - uses: actions/checkout@v6 - with: - ref: ${{ inputs.ref || github.ref }} # Node.js - uses: pnpm/action-setup@v5 @@ -190,7 +176,6 @@ jobs: steps: - uses: actions/checkout@v6 with: - ref: ${{ inputs.ref || github.ref }} fetch-depth: 0 - uses: danielroe/provenance-action@main id: check diff --git a/.github/workflows/update-nix-assets-hash.yaml b/.github/workflows/update-nix-assets-hash.yaml index 1f22bdd12..26b2980c6 100644 --- a/.github/workflows/update-nix-assets-hash.yaml +++ b/.github/workflows/update-nix-assets-hash.yaml @@ -17,8 +17,6 @@ jobs: update: if: github.event_name == 'workflow_dispatch' || !github.event.repository.fork runs-on: ubuntu-latest - outputs: - has_changes: ${{ steps.changes.outputs.has_changes }} steps: # Why? # @@ -32,6 +30,8 @@ jobs: - uses: actions/checkout@v6 with: ref: main # Use main regardless of workflow_dispatch branch + # Authenticate git with PAT so that pushing to head retriggers CI + token: ${{ secrets.HASH_UPDATE_TOKEN }} - uses: cachix/install-nix-action@v31 with: @@ -52,7 +52,8 @@ jobs: - name: Create PR if: steps.changes.outputs.has_changes == 'true' env: - GH_TOKEN: ${{ github.token }} + # Create PR with PAT to trigger CI + GH_TOKEN: ${{ secrets.HASH_UPDATE_TOKEN }} run: | git config user.name "github-actions[bot]" git config user.email "github-actions[bot]@users.noreply.github.com" @@ -72,11 +73,3 @@ jobs: # Enable auto-merge so PR merges once checks pass gh pr merge --squash --auto --delete-branch chore/update-nix-assets-hash - - # Call CI as reusable workflow because bot PR doesn't trigger CI - ci: - needs: update - if: needs.update.outputs.has_changes == 'true' - uses: ./.github/workflows/ci.yml - with: - ref: chore/update-nix-assets-hash diff --git a/.github/workflows/update-nix-pnpm-deps-hash.yaml b/.github/workflows/update-nix-pnpm-deps-hash.yaml index ca606ba65..3017db639 100644 --- a/.github/workflows/update-nix-pnpm-deps-hash.yaml +++ b/.github/workflows/update-nix-pnpm-deps-hash.yaml @@ -16,8 +16,6 @@ jobs: update: if: github.event_name == 'workflow_dispatch' || !github.event.repository.fork runs-on: ubuntu-latest - outputs: - has_changes: ${{ steps.changes.outputs.has_changes }} steps: # Why? # @@ -31,6 +29,8 @@ jobs: - uses: actions/checkout@v6 with: ref: main # Use main regardless of workflow_dispatch branch + # Authenticate git with PAT so that pushing to head retriggers CI + token: ${{ secrets.HASH_UPDATE_TOKEN }} - uses: cachix/install-nix-action@v31 with: @@ -51,7 +51,8 @@ jobs: - name: Create PR if: steps.changes.outputs.has_changes == 'true' env: - GH_TOKEN: ${{ github.token }} + # Create PR with PAT to trigger CI + GH_TOKEN: ${{ secrets.HASH_UPDATE_TOKEN }} run: | git config user.name "github-actions[bot]" git config user.email "github-actions[bot]@users.noreply.github.com" @@ -71,11 +72,3 @@ jobs: # Enable auto-merge so PR merges once checks pass gh pr merge --squash --auto --delete-branch chore/update-nix-pnpm-deps-hash - - # Call CI as reusable workflow because bot PR doesn't trigger CI - ci: - needs: update - if: needs.update.outputs.has_changes == 'true' - uses: ./.github/workflows/ci.yml - with: - ref: chore/update-nix-pnpm-deps-hash