Skip to content

fix(ci): use RELEASE_PAT for git-push in bump-sha workflow #167

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
YiWang24 merged 1 commit into from
May 26, 2026
Merged

fix(ci): use RELEASE_PAT for git-push in bump-sha workflow #167

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 21 additions & 26 deletions .github/workflows/on-main-bump-sha.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,12 +7,10 @@
# as main moves forward) the SHA can become stale. This workflow detects
# that condition and creates a one-commit PR to fix it automatically.
#
# The commit is pushed via standard git-push with the built-in
# github.token. Workflow file (.github/workflows/) changes are reverted
# before committing because github.token cannot push workflow files even
# with contents:write — only manifest.yml (and optionally actions/) is
# committed. External repos rely on manifest.yml for the pinned SHA;
# stale internal workflow references are harmless.
# The commit is pushed via git-push with RELEASE_PAT (a classic PAT with
# the `workflow` OAuth scope). github.token cannot push .github/workflows/
# files — it requires a non-existent "workflows" permission. RELEASE_PAT
# bypasses this restriction, keeping all SHA references in sync.
name: Auto-bump self SHA

on:
Expand Down Expand Up @@ -40,10 +38,9 @@ jobs:
- uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493
with:
fetch-depth: 0
# Default persist-credentials=true persists github.token as the
# git remote credential. This lets bump-self-sha.sh git-fetch
# AND lets us git-push the bump branch back — but only for
# manifest.yml/actions/ (workflow files are reverted).
# persist-credentials so bump-self-sha.sh can git-fetch.
# The push itself overrides the remote URL to use RELEASE_PAT
# (which has the `workflow` scope for .github/workflows/ pushes).

# Break the infinite-loop: if THIS push was produced by a previous
# run of this workflow (bot-authored bump commit or bump PR merge),
Expand Down Expand Up @@ -106,17 +103,18 @@ jobs:
if: steps.guard.outputs.skip != 'true' && steps.check.outputs.skip != 'true'
run: bash scripts/bump-self-sha.sh

# ── Push via git-push with github.token ───────────────────────────────
# github.token uses fine-grained permissions (contents: write) and
# CANNOT push .github/workflows/ changes — that requires the non-
# existent "workflows" permission. We restore workflow files before
# committing so only manifest.yml (+ optionally actions/) is pushed.
# ── Push via git-push with RELEASE_PAT ─────────────────────────────────
# github.token cannot push .github/workflows/ changes (requires the
# non-existent "workflows" permission). RELEASE_PAT is a classic PAT
# with the `workflow` OAuth scope — it CAN push workflow files. We
# override the git remote URL to use RELEASE_PAT for the push only.
- name: Push branch with changes
id: push-branch
if: steps.guard.outputs.skip != 'true' && steps.check.outputs.skip != 'true'
env:
NEW_SHA: ${{ steps.check.outputs.new_sha }}
OLD_SHA: ${{ steps.check.outputs.current_sha }}
RELEASE_PAT: ${{ secrets.RELEASE_PAT }}
run: |
set -euo pipefail

Expand All @@ -125,17 +123,8 @@ jobs:
commit_msg="chore(manifest): bump YiAgent/OpenCI SHA to ${short_new}"
commit_body="Automated update from on-main-bump-sha workflow. old=${OLD_SHA} new=${NEW_SHA}"

# bump-self-sha.sh modifies all files containing the old SHA
# (including .github/workflows/*.yml). github.token cannot push
# workflow file changes, so we revert them — only manifest.yml
# (and actions/) changes are committed. External repos rely on
# manifest.yml for the pinned SHA; internal workflow references
# lag slightly behind, which is harmless (reusable workflows
# exist at old SHAs in repo history).
git checkout -- .github/workflows/

# Collect changed files.
changed=$(git diff --name-only HEAD -- manifest.yml actions/ 2>/dev/null || true)
changed=$(git diff --name-only HEAD -- manifest.yml .github/workflows/ actions/ 2>/dev/null || true)
if [ -z "$changed" ]; then
echo "::notice::No files changed — nothing to commit"
echo "skip=true" >> "$GITHUB_OUTPUT"
Expand All @@ -150,8 +139,14 @@ jobs:

# Stage, commit, and push to a new branch.
git checkout -b "${branch}"
git add manifest.yml actions/
git add manifest.yml .github/workflows/ actions/
git commit -m "${commit_msg}" -m "${commit_body}"

# Use RELEASE_PAT for the push — github.token cannot push
Comment on lines 140 to +145

@greptile-apps greptile-apps Bot May 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 If RELEASE_PAT is not configured in the repository secrets, GitHub Actions passes an empty string rather than an unset variable, so set -u does not catch it. The push then silently attempts authentication with an empty token and fails at git push with a generic auth error instead of a clear actionable message. An explicit guard here makes the misconfiguration immediately obvious.

Suggested change
# Stage, commit, and push to a new branch.
git checkout -b "${branch}"
git add manifest.yml actions/
git add manifest.yml .github/workflows/ actions/
git commit -m "${commit_msg}" -m "${commit_body}"
# Use RELEASE_PAT for the push — github.token cannot push
# Stage, commit, and push to a new branch.
git checkout -b "${branch}"
git add manifest.yml .github/workflows/ actions/
git commit -m "${commit_msg}" -m "${commit_body}"
# Validate RELEASE_PAT is present before using it.
[ -n "${RELEASE_PAT}" ] || { echo "::error::RELEASE_PAT secret is not configured"; exit 1; }
# Use RELEASE_PAT for the push — github.token cannot push

# .github/workflows/ files (requires "workflows" permission
# which doesn't exist in workflow syntax).
git remote set-url origin \
"https://x-access-token:${RELEASE_PAT}@github.com/${GITHUB_REPOSITORY}.git"
git push origin "${branch}"
echo "::notice::Pushed branch ${branch}"
Comment on lines +148 to 151

@greptile-apps greptile-apps Bot May 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 security The RELEASE_PAT remains embedded in the git remote URL after the push completes. Any subsequent git operation in this job (or a future step added later) would still use it, and verbose git output or error messages could surface the full URL. Resetting the remote back to the unauthenticated HTTPS form immediately after the push limits the credential's exposure window.

Suggested change
git remote set-url origin \
"https://x-access-token:${RELEASE_PAT}@github.com/${GITHUB_REPOSITORY}.git"
git push origin "${branch}"
echo "::notice::Pushed branch ${branch}"
git remote set-url origin \
"https://x-access-token:${RELEASE_PAT}@github.com/${GITHUB_REPOSITORY}.git"
git push origin "${branch}"
git remote set-url origin "https://github.com/${GITHUB_REPOSITORY}.git"
echo "::notice::Pushed branch ${branch}"


Expand Down
8 changes: 4 additions & 4 deletions tests/actions/workflow-integrity.bats
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,10 +136,10 @@ setup() {
[ "$status" -eq 0 ]
}

@test "on-main-bump-sha.yml restores workflow files before committing" {
@test "on-main-bump-sha.yml uses RELEASE_PAT for git push" {
# github.token cannot push .github/workflows/ changes. Verify the
# workflow reverts them (git checkout -- .github/workflows/) before
# staging only manifest.yml and actions/.
run grep -F 'git checkout -- .github/workflows/' "$WORKFLOWS_DIR/on-main-bump-sha.yml"
# workflow overrides the git remote URL to use RELEASE_PAT, which
# has the `workflow` OAuth scope for pushing workflow files.
run grep -F 'RELEASE_PAT}@github.com' "$WORKFLOWS_DIR/on-main-bump-sha.yml"
[ "$status" -eq 0 ]
}
Loading