fix(ci): use github.token for bump-sha API push#160
Conversation
The openbot/dev GITHUB_TOKEN (RELEASE_PAT) belongs to YiWang24 who lacks write access to YiAgent/OpenCI, causing 404 on all API write operations. The built-in github.token has full write access to the repo and works fine with the REST API approach since we no longer need the workflow scope that git-over-HTTPS requires.
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThis PR simplifies GitHub API authentication in the on-main-bump-sha workflow by removing the ChangesGitHub API Authentication Simplification
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes Possibly related PRs
Suggested labels
Poem
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![openbot-dev[bot]](https://avatars.githubusercontent.com/u/279808688?s=60&v=4){kind=small}
|
1 participant
Problem
The auto-bump-sha workflow used
secrets.RELEASE_PAT(openbot/dev GITHUB_TOKEN belonging to YiWang24). This Classic PAT hasreposcope but YiWang24 lacks write access to YiAgent/OpenCI, causing all API write operations to return HTTP 404.Root Cause
Even with
reposcope on a Classic PAT, GitHub returns 404 (not 403) for write operations when the token user lacks collaborator permissions on the target repo.Fix
Replace
${{ secrets.RELEASE_PAT || github.token }}with${{ github.token }}forGH_TOKEN. The built-ingithub.tokenhas full write access to the repo, and our API-based push doesn not need theworkflowscope that git-over-HTTPS requires.Need help on this PR? Tag
@codesmithwith what you need. Autofix is disabled.Summary by CodeRabbit
Greptile Summary
This PR fixes the auto-bump-sha workflow by replacing
secrets.RELEASE_PAT || github.tokenwithgithub.tokenin both the API push step and the PR management step. The previous PAT belonged to a user without write access to this repo, causing all write operations to return HTTP 404.permissions: contents: writeandpull-requests: write, sogithub.tokenhas the necessary scope for every API call the workflow makes (creating blobs, trees, commits, refs, and managing PRs).line 42-43and the block above "Push commit via GitHub API") still reference "RELEASE_PAT or github.token" and should be updated to reflect the new, PAT-free approach.Confidence Score: 4/5
Safe to merge — the fix correctly replaces a broken PAT with the built-in token, and the required contents:write / pull-requests:write permissions are already declared at the workflow level.
The functional change is correct and minimal. Two block comments inside the file still refer to RELEASE_PAT or github.token and remain misleading after the fix, but they do not affect runtime behavior.
.github/workflows/on-main-bump-sha.yml — specifically the two stale inline comments that still mention RELEASE_PAT.
Important Files Changed
Sequence Diagram
sequenceDiagram participant GH as GitHub Actions participant GT as github.token participant API as GitHub Git Database API participant PR as Pull Request API GH->>GT: Resolve token (built-in, repo-scoped) Note over GT: contents:write + pull-requests:write GT-->>GH: Token with scoped permissions GH->>API: POST /git/blobs (upload file content) API-->>GH: blob SHA GH->>API: POST /git/trees (create new tree) API-->>GH: tree SHA GH->>API: POST /git/commits (create commit object) API-->>GH: commit SHA GH->>API: PATCH/POST /git/refs (update/create branch) API-->>GH: ref updated GH->>PR: gh pr list (find old bump PRs) PR-->>GH: list of open PRs GH->>PR: gh pr close (close superseded PRs) GH->>PR: gh pr create (open new bump PR)Comments Outside Diff (2)
.github/workflows/on-main-bump-sha.yml, line 42-43 (link)RELEASE_PAT or github.token, which is now stale after this change..github/workflows/on-main-bump-sha.yml, line 107-111 (link)RELEASE_PAT or github.tokenon the last line, which is now stale.Reviews (1): Last reviewed commit: "fix(ci): use github.token for bump-sha A..." | Re-trigger Greptile