fix(ci): publish agent skills releases with the job's own token - #91885
Conversation
The release steps minted a token from the paths-filter GitHub App, which is a read-only app. Since 2026-08-03 the release API returns 403, so no skills.zip has shipped and the PostHog AI plugin syncs a frozen catalog. The job already declares contents: write, so use github.token, matching build-phrocs.yml and build-livestream-tui.yml. No workflow triggers off these releases, so the app token bought nothing. Generated-By: PostHog Desktop Task-Id: b2be3049-0d16-4222-86f2-404d47c20a02
|
😎 Merged successfully - details. |
|
Hey @skoob13! 👋 It looks like your git author email on this PR isn't your
You can fix it for this repo with: git config user.email "you@posthog.com"Or set it globally with |
🤖 CI report
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Prompt To Fix All With AI### Issue 1
.github/workflows/ci-agent-skills.yml:528-530
The new comment records why the previous app-token implementation was removed, duplicating context already captured in the commit and PR description. Keeping this history beside the release step adds maintenance cost when that context becomes stale.
```suggestion
```
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.Reviews (1): Last reviewed commit: "fix(ci): publish agent skills releases w..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| # The job's own contents:write GITHUB_TOKEN, like build-phrocs.yml and | ||
| # build-livestream-tui.yml. No workflow triggers off these releases, so the | ||
| # app token bought nothing and only added a permission that can drift away. |
There was a problem hiding this comment.
| # The job's own contents:write GITHUB_TOKEN, like build-phrocs.yml and | |
| # build-livestream-tui.yml. No workflow triggers off these releases, so the | |
| # app token bought nothing and only added a permission that can drift away. |
Context Used: AGENTS.MD (source)
Prompt To Fix With AI
This is a comment left during a code review.
Path: .github/workflows/ci-agent-skills.yml
Line: 528-530
Comment:
The new comment records why the previous app-token implementation was removed, duplicating context already captured in the commit and PR description. Keeping this history beside the release step adds maintenance cost when that context becomes stale.
```suggestion
```
**Context Used:** AGENTS.MD ([source](https://github.com/posthog/posthog/blob/master/AGENTS.MD))
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
2 participants
Problem
Anyone using the PostHog plugin for Claude Code, Codex, Cursor, or Gemini has been getting a skills catalog frozen at the 3 August build. Every skill written or edited in the four weeks since then never reached them.
Release agent skillsjob publishesskills.zipto theagent-skills-latestrelease on each master push. The plugin's daily sync downloads that asset.HTTP 403: Resource not accessible by integration(failing job). The last published tag isagent-skills-v0.715.0.Changes
agent-skills-v0.*tag and refreshesagent-skills-lateston each master push.github.token. The job already declarescontents: write, which is whatbuild-phrocs.ymlandbuild-livestream-tui.ymldo for the same job.Nothing user-visible changes in the product, and nothing triggers off these releases, so dropping the app token costs no downstream workflow run.
Note
This unblocks the producer only. On the consumer side, PostHog/ai-plugin#203 still needs to land: the plugin's sync workflow requests review from a renamed team, so
gh pr createexits 1 andgh pr merge --autonever runs. Until then a freshskills.zipopens a sync PR that waits for a manual merge.How did you test this code?
bin/hogli lint:workflows: 8 checks pass across 128 workflows.contents: writeonGITHUB_TOKENfor release creation. build-phrocs publishes releases that way and last succeeded on 5 August, after the app token started failing, which is the evidence this works.actionlintwas not run; it is not installed in this sandbox.Automatic notifications
Docs update
None.
🤖 Agent context
Autonomy: Human-driven (agent-assisted)
Written by the PostHog Slack app from a Slack thread about the PostHog AI plugin shipping a stale and oversized skills catalog. The thread named the frozen sync job as a known but undiagnosed problem.
Skills invoked:
/authoring-ci-workflows,/writing-pr-descriptions.The investigation started from the plugin repo, where the daily sync workflow also fails, and traced the frozen catalog one step upstream to this job. Two independent breaks sit on the same path; this PR fixes the producer, and the linked plugin PR fixes the consumer.
The alternative was minting a token from a write-capable app such as
GH_APP_POSTHOG_RELEASER.github.tokenwas chosen because the job already holds the permission, it removes a step, and it matches the two sibling release workflows in this repo.No PR assignee is set: the requester's GitHub handle was not verifiable from the Slack thread, and guessing one tags an unrelated account.
Created with PostHog from a Slack thread