Skip to content

Use a publish-only GitHub App token for PR-mode package updates - #204

Merged
woksin merged 2 commits into
mainfrom
workflows-243-app-token
Oct 23, 2026
Merged

woksin merged 2 commits into
mainfrom
workflows-243-app-token

Conversation

@woksin

@woksin woksin commented Oct 23, 2026

Copy link
Copy Markdown
Contributor

Added

  • Package-update pull requests can be published with a short-lived GitHub App installation token instead of PAT_WORKFLOWS when the caller sets the CRATIS_AUTOMATION_APP_ID variable and passes the AUTOMATION_APP_PRIVATE_KEY secret; direct mode and callers without the App keep the existing token path. (part of Cratis/Infrastructure#243)

@woksin woksin self-assigned this Oct 23, 2026
@woksin

woksin commented Oct 23, 2026

Copy link
Copy Markdown
Contributor Author

Reviewer notes

  • Deep cross-provider review (Opus + Astra) round 1 passed, no blocking findings; advisory (org-level variable would fail publish in callers that do not pass the key) addressed in README.
  • update-packages.test.py 118 OK locally; actionlint clean.
  • Not exercised live: the App does not exist yet (woksin, Q-32). Pilot on one repository once it exists.

@woksin
woksin merged commit 9197e49 into main Oct 23, 2026
12 checks passed
@woksin
woksin deleted the workflows-243-app-token branch October 23, 2026 19:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant