From eefb6a5c024bfd4aaaac6ef66d58ed1e3b57811a Mon Sep 17 00:00:00 2001 From: Mahendra Paipuri Date: Sun, 5 Jul 2026 16:56:20 +0200 Subject: [PATCH 1/3] ci: Debug app token creation Signed-off-by: Mahendra Paipuri --- .github/workflows/step_tests-unit.yml | 10 +++++----- .github/workflows/update-citation.yml | 6 +++--- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/step_tests-unit.yml b/.github/workflows/step_tests-unit.yml index 22a69208..127b2d18 100644 --- a/.github/workflows/step_tests-unit.yml +++ b/.github/workflows/step_tests-unit.yml @@ -77,13 +77,13 @@ jobs: # to push the changes to remote - uses: actions/create-github-app-token@v3 id: app-token - if: steps.verify-changed-files.outputs.files_changed == 'true' && github.ref == 'refs/heads/main' + if: steps.verify-changed-files.outputs.files_changed == 'true' with: - app-id: 4221824 + client-id: 4221824 private-key: ${{ secrets.APP_UPDATE_README_HELPER_PRIVATE_KEY }} - name: Commit changes - if: steps.verify-changed-files.outputs.files_changed == 'true' && github.ref == 'refs/heads/main' + if: steps.verify-changed-files.outputs.files_changed == 'true' run: | git config --local user.email "bot@ceems.com" git config --local user.name "CEEMS Bot" @@ -91,8 +91,8 @@ jobs: git commit -m "chore: Updated coverage badge" -s - name: Push changes - if: steps.verify-changed-files.outputs.files_changed == 'true' && github.ref == 'refs/heads/main' + if: steps.verify-changed-files.outputs.files_changed == 'true' uses: ad-m/github-push-action@master with: github_token: ${{ steps.app-token.outputs.token }} - branch: ${{ github.head_ref }} + branch: ${{ github.ref }} diff --git a/.github/workflows/update-citation.yml b/.github/workflows/update-citation.yml index 6bba460d..22237a02 100644 --- a/.github/workflows/update-citation.yml +++ b/.github/workflows/update-citation.yml @@ -39,11 +39,11 @@ jobs: id: app-token if: steps.verify-changed-files.outputs.files_changed == 'true' && github.ref == 'refs/heads/main' with: - app-id: 4221824 + client-id: 4221824 private-key: ${{ secrets.APP_UPDATE_README_HELPER_PRIVATE_KEY }} - name: Commit changes - if: steps.verify-changed-files.outputs.files_changed == 'true' && && github.ref == 'refs/heads/main' + if: steps.verify-changed-files.outputs.files_changed == 'true' && github.ref == 'refs/heads/main' run: | git config --local user.email "bot@ceems.com" git config --local user.name "CEEMS bot" @@ -51,7 +51,7 @@ jobs: git commit -m "chore: Update version in CITATION.cff" -s - name: Push changes - if: steps.verify-changed-files.outputs.files_changed == 'true' && && github.ref == 'refs/heads/main' + if: steps.verify-changed-files.outputs.files_changed == 'true' && github.ref == 'refs/heads/main' uses: ad-m/github-push-action@master with: github_token: ${{ steps.app-token.outputs.token }} From d349173be16d7b5667cfeeb3c2b1553b009ca29e Mon Sep 17 00:00:00 2001 From: Mahendra Paipuri Date: Sun, 5 Jul 2026 17:08:53 +0200 Subject: [PATCH 2/3] ci: Make app private key secret available in reusable workflow Signed-off-by: Mahendra Paipuri --- .github/workflows/ci.yml | 2 ++ .github/workflows/step_tests-unit.yml | 5 ++++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 614131ec..51da3819 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -54,6 +54,8 @@ jobs: test-unit: needs: [test-lint] uses: ./.github/workflows/step_tests-unit.yml + secrets: + app_private_key: ${{ secrets.APP_UPDATE_README_HELPER_PRIVATE_KEY }} test-e2e: needs: [test-lint, test-unit] diff --git a/.github/workflows/step_tests-unit.yml b/.github/workflows/step_tests-unit.yml index 127b2d18..91e5245b 100644 --- a/.github/workflows/step_tests-unit.yml +++ b/.github/workflows/step_tests-unit.yml @@ -3,6 +3,9 @@ run-name: Unit Tests on: workflow_call: + secrets: + app_private_key: + required: true jobs: unit-tests: @@ -80,7 +83,7 @@ jobs: if: steps.verify-changed-files.outputs.files_changed == 'true' with: client-id: 4221824 - private-key: ${{ secrets.APP_UPDATE_README_HELPER_PRIVATE_KEY }} + private-key: ${{ secrets.app_private_key }} - name: Commit changes if: steps.verify-changed-files.outputs.files_changed == 'true' From 26948421307e1b22109a8f2342f13806df7a05c6 Mon Sep 17 00:00:00 2001 From: Mahendra Paipuri Date: Sun, 5 Jul 2026 17:17:56 +0200 Subject: [PATCH 3/3] ci: Revert changes to workflow file Signed-off-by: Mahendra Paipuri --- .github/workflows/step_tests-unit.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/step_tests-unit.yml b/.github/workflows/step_tests-unit.yml index 91e5245b..dd431e2c 100644 --- a/.github/workflows/step_tests-unit.yml +++ b/.github/workflows/step_tests-unit.yml @@ -80,13 +80,13 @@ jobs: # to push the changes to remote - uses: actions/create-github-app-token@v3 id: app-token - if: steps.verify-changed-files.outputs.files_changed == 'true' + if: steps.verify-changed-files.outputs.files_changed == 'true' && github.ref == 'refs/heads/main' with: client-id: 4221824 private-key: ${{ secrets.app_private_key }} - name: Commit changes - if: steps.verify-changed-files.outputs.files_changed == 'true' + if: steps.verify-changed-files.outputs.files_changed == 'true' && github.ref == 'refs/heads/main' run: | git config --local user.email "bot@ceems.com" git config --local user.name "CEEMS Bot" @@ -94,8 +94,8 @@ jobs: git commit -m "chore: Updated coverage badge" -s - name: Push changes - if: steps.verify-changed-files.outputs.files_changed == 'true' + if: steps.verify-changed-files.outputs.files_changed == 'true' && github.ref == 'refs/heads/main' uses: ad-m/github-push-action@master with: github_token: ${{ steps.app-token.outputs.token }} - branch: ${{ github.ref }} + branch: ${{ github.head_ref }}