fix(ci): use RELEASE_PAT for git-push in bump-sha workflow#167
Conversation
github.token cannot push .github/workflows/ files — it requires a 'workflows' permission that doesn't exist in workflow syntax. Switch to RELEASE_PAT (a classic PAT with 'workflow' OAuth scope) for the git-push step by overriding the remote URL. This means all SHA references (.github/workflows/, actions/, manifest.yml) stay in sync — the verify-sha-consistency check will pass. We no longer need to revert workflow file changes before pushing.
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
|
Warning Review limit reached
More reviews will be available in 17 minutes and 13 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
![openbot-dev[bot]](https://avatars.githubusercontent.com/u/279808688?s=60&v=4){kind=small}
There was a problem hiding this comment.
The diff switches from reverting workflow files before push to using RELEASE_PAT for authentication, which is a sound approach but has a few hygiene/safety concerns.
Repo-wide notes:
- medium —
.github/workflows/on-main-bump-sha.yml: The PAT is embedded directly in the remote URL. Ifset -euo pipefailis off orgit pushleaks the URL in error output, the token could appear in GitHub Actions logs. Consider using a GIT_ASKPASS helper orgit credential approveto avoid the token in the URL string.
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| git remote set-url origin \ | ||
| "https://x-access-token:${RELEASE_PAT}@github.com/${GITHUB_REPOSITORY}.git" | ||
| git push origin "${branch}" | ||
| echo "::notice::Pushed branch ${branch}" |
There was a problem hiding this comment.
| git remote set-url origin \ | |
| "https://x-access-token:${RELEASE_PAT}@github.com/${GITHUB_REPOSITORY}.git" | |
| git push origin "${branch}" | |
| echo "::notice::Pushed branch ${branch}" | |
| git remote set-url origin \ | |
| "https://x-access-token:${RELEASE_PAT}@github.com/${GITHUB_REPOSITORY}.git" | |
| git push origin "${branch}" | |
| git remote set-url origin "https://github.com/${GITHUB_REPOSITORY}.git" | |
| echo "::notice::Pushed branch ${branch}" |
| # Stage, commit, and push to a new branch. | ||
| git checkout -b "${branch}" | ||
| git add manifest.yml actions/ | ||
| git add manifest.yml .github/workflows/ actions/ | ||
| git commit -m "${commit_msg}" -m "${commit_body}" | ||
|
|
||
| # Use RELEASE_PAT for the push — github.token cannot push |
There was a problem hiding this comment.
RELEASE_PAT is not configured in the repository secrets, GitHub Actions passes an empty string rather than an unset variable, so set -u does not catch it. The push then silently attempts authentication with an empty token and fails at git push with a generic auth error instead of a clear actionable message. An explicit guard here makes the misconfiguration immediately obvious.
| # Stage, commit, and push to a new branch. | |
| git checkout -b "${branch}" | |
| git add manifest.yml actions/ | |
| git add manifest.yml .github/workflows/ actions/ | |
| git commit -m "${commit_msg}" -m "${commit_body}" | |
| # Use RELEASE_PAT for the push — github.token cannot push | |
| # Stage, commit, and push to a new branch. | |
| git checkout -b "${branch}" | |
| git add manifest.yml .github/workflows/ actions/ | |
| git commit -m "${commit_msg}" -m "${commit_body}" | |
| # Validate RELEASE_PAT is present before using it. | |
| [ -n "${RELEASE_PAT}" ] || { echo "::error::RELEASE_PAT secret is not configured"; exit 1; } | |
| # Use RELEASE_PAT for the push — github.token cannot push |
1 participant
Problem
github.tokencannot push.github/workflows/changes. Our previous workaround (reverting workflow files) causedci-self-testverify-sha-consistencyfailures because workflow SHA references lag behindmanifest.yml.Fix
Use
RELEASE_PAT(a classic PAT withworkflowOAuth scope) for the git-push step by overriding the remote URL:git remote set-url origin "https://x-access-token:${RELEASE_PAT}@github.com/${GITHUB_REPOSITORY}.git"This means all SHA references stay in sync — no more
verify-sha-consistencyfailures.## Other changes carried forward
steps.guard.outputs.skipcheck in Manage PRs stepgh pr merge --auto --squashafter PR creationno-issue
Need help on this PR? Tag
@codesmithwith what you need. Autofix is disabled.Greptile Summary
This PR replaces the previous workaround (reverting
.github/workflows/files before committing) with a cleaner approach: overriding the git remote URL to useRELEASE_PAT(a classic PAT withworkflowOAuth scope) so all SHA references — including workflow files — are committed and pushed together.on-main-bump-sha.yml): Removes thegit checkout -- .github/workflows/revert step; instead injects the PAT into the remote URL just beforegit push, and now stages.github/workflows/alongsidemanifest.ymlandactions/.if:condition now correctly gates onsteps.push-branch.outputs.skip.gh pr merge --auto --squashis added after PR creation so approved bump PRs merge without manual intervention.workflow-integrity.bats): Replaces the old revert-grep with a check for the new PAT remote-URL pattern.Confidence Score: 4/5
Safe to merge with minor hardening — the credential-in-remote-URL lingers after the push and an empty RELEASE_PAT secret is not caught early.
The core approach is sound and correctly addresses the root cause. Minor hardening opportunities exist around credential lifetime and missing-secret detection, but neither blocks correct operation when the secret is properly configured.
on-main-bump-sha.yml — specifically the push block (remote URL credential lifetime) and the auto-merge section (stale comment).
Security Review
on-main-bump-sha.yml, lines 148–150):RELEASE_PATis embedded in the remote URL viagit remote set-urland is never cleared after the push. GitHub Actions masks the raw token value in logs, but the URL remains in the git config for the rest of the job. Resetting the remote URL to the unauthenticated form immediately after the push is recommended.manifest.ymlchanges; they now also include.github/workflows/modifications. The scope is constrained to SHA reference substitutions, so practical risk is low, but branch protection rules should be verified to cover this automated path.Important Files Changed
Comments Outside Diff (1)
.github/workflows/on-main-bump-sha.yml, line 213-216 (link).github/workflows/changes. This stale comment will mislead anyone auditing this workflow later.Reviews (1): Last reviewed commit: "fix(ci): use RELEASE_PAT for git-push in..." | Re-trigger Greptile