Repository navigation
merge gate: the template-sync App allowance is live-only until the fleet token can resolve App nodes - #226
Merged
Conversation
…eet token can resolve App nodes Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
cpitzi
enabled auto-merge (squash)
October 4, 2026 23:56
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configuration
📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
terraform plan (success) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reverts the
gate_extra_allowancesentries from #224 and records why inlocals.tf. The apply of #224 (run 37245027986 and its rerun) failed on all threemerge_gateresources withCould not resolve to a node with the global id of 'A_kwHOEcLpC84ATzVN':FLEET_ADMIN_TOKENis a fine-grained PAT and cannot resolve the private App's node, and the rerun still planned a modification after the App had been added live, so it cannot read the allowance back either. With the entries declared, every apply onmainfails at these three resources, which blocks the fleet's enforcement loop for unrelated changes.The App remains on the three allowlists live (added through the REST endpoint by an org owner; read back with
gh api repos/lentago/<repo>/branches/main/protection --jq '.restrictions.apps[].slug'), which is what lets lentago/uvularia's template-sync workflow arm auto-merge. Terraform does not see that allowance, so there is no plan diff; any future change to those repos' allowlist will drop it silently until the token identity is fixed. #225 tracks the fix and the restore of these entries.🤖 Generated with Claude Code