fix(ci): open publish-dist PRs with ak2k-ci App token so auto-merge fires#32
Merged
Conversation
publish-dist's peter-evans/create-pull-request step used the default GITHUB_TOKEN. GitHub suppresses ALL events for a PR opened by GITHUB_TOKEN -- including pull_request_target -- so ci.yml never ran on the auto-PR and auto-merge-publish-dist's gate (a green `nix flake check` on the PR head) was never satisfied. Every bump has needed a manual merge; auto-merge has effectively never closed the loop. Mint a short-lived ak2k-ci App installation token (actions/create-github-app-token@v3) and hand it to peter-evans. ci.yml triggers on pull_request, so an App-token PR runs ci naturally -> workflow_run: ci -> Phase 2 direct-merges when green. Phase 1's pull_request_target dispatch is now a redundant fallback. Also corrected the auto-merge header comment, which wrongly claimed pull_request_target fires for GITHUB_TOKEN PRs. Requires repo secrets CI_APP_ID + CI_APP_PRIVATE_KEY and the ak2k-ci App installed on ak2k/ce-lite (contents + pull-requests write). Merge only after those are in place -- otherwise publish-dist fails at the token step.
ak2k
added a commit
that referenced
this pull request
May 26, 2026
…e pitfall (#33) - Add a "Workflow pitfalls" note: measure idle cost via interactive /context (the Custom agents slot), NOT `claude plugin details` -- the latter's Always-on projection counts agent descriptions (~50 tok/agent) and misses the loaded bodies (~2k/agent), under-reporting by ~15x. - Refresh the publish-dist pitfall: it claimed ci.yml doesn't run on auto-PRs and "those checks are the validation signal" -- stale since PR #32 wired the ak2k-ci App token, which makes the auto-PR fire pull_request -> ci -> auto-merge. Documents the App-token mechanism.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
publish-distopened its auto-PR with the defaultGITHUB_TOKEN. GitHub suppresses every event for a PR created byGITHUB_TOKEN— includingpull_request_target— soci.ymlnever ran on the auto-PR andauto-merge-publish-dist's gate (a greennix flake checkon the PR head) was never satisfiable. Result: auto-merge has never closed the loop — every bump (including #31, just now) needed a manual merge. The converter fix unblocked the run; this is the second broken link.What
publish-dist.yml: mint a short-livedak2k-ciApp token (actions/create-github-app-token@v3) and pass it topeter-evans/create-pull-request.ci.ymltriggers onpull_request, so an App-token PR runs ci naturally →workflow_run: ci→ auto-merge Phase 2 direct-merges when green.auto-merge-publish-dist.yml: fix the comment that wrongly claimedpull_request_targetfires forGITHUB_TOKENPRs; note Phase 1 is now a redundant fallback.nix flake check(actionlint + treefmt + pytest) passes locally.This change is inert (and would break
publish-distat the token step) until both are in place:ak2k-ciApp onak2k/ce-litewithcontents: write+pull-requests: write.secrets/ci.yaml):Once set, the next upstream release self-completes: cron → publish-dist → App-token PR → ci → auto-merge.