From a61d0681e692f2d61f0b3cfefa30f1c763ddd78a Mon Sep 17 00:00:00 2001
From: ak2k <19240940+ak2k@users.noreply.github.com>
Date: Mon, 25 May 2026 09:14:25 -0400
Subject: [PATCH] fix(ci): open publish-dist PRs with the ak2k-ci App token

publish-dist's peter-evans/create-pull-request step used the default
GITHUB_TOKEN. GitHub suppresses ALL events for a PR opened by
GITHUB_TOKEN -- including pull_request_target -- so ci.yml never ran on
the auto-PR and auto-merge-publish-dist's gate (a green `nix flake check`
on the PR head) was never satisfied. Every bump has needed a manual
merge; auto-merge has effectively never closed the loop.

Mint a short-lived ak2k-ci App installation token
(actions/create-github-app-token@v3) and hand it to peter-evans. ci.yml
triggers on pull_request, so an App-token PR runs ci naturally ->
workflow_run: ci -> Phase 2 direct-merges when green. Phase 1's
pull_request_target dispatch is now a redundant fallback. Also corrected
the auto-merge header comment, which wrongly claimed pull_request_target
fires for GITHUB_TOKEN PRs.

Requires repo secrets CI_APP_ID + CI_APP_PRIVATE_KEY and the ak2k-ci App
installed on ak2k/ce-lite (contents + pull-requests write). Merge only
after those are in place -- otherwise publish-dist fails at the token step.
---
 .github/workflows/auto-merge-publish-dist.yml | 17 ++++++++++-------
 .github/workflows/publish-dist.yml            | 12 ++++++++++++
 2 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/auto-merge-publish-dist.yml b/.github/workflows/auto-merge-publish-dist.yml
index a3dd523..ffa39ab 100644
--- a/.github/workflows/auto-merge-publish-dist.yml
+++ b/.github/workflows/auto-merge-publish-dist.yml
@@ -7,10 +7,12 @@ name: auto-merge-publish-dist
 # from the API, bypassing GitHub's `--auto` facility entirely. This
 # sidesteps two gotchas in one stroke:
 #
-#  - `peter-evans/create-pull-request@v8` with the default `GITHUB_TOKEN`
-#    doesn't fire `pull_request.opened` events (anti-recursion safeguard).
-#    `pull_request_target` and `workflow_run` BOTH fire regardless. Either
-#    is sufficient to drive the merge.
+#  - publish-dist opens its PR with the `ak2k-ci` GitHub App token (NOT the
+#    default `GITHUB_TOKEN`). This matters: GitHub suppresses ALL events for a
+#    PR opened by `GITHUB_TOKEN` -- including `pull_request_target` -- which
+#    silently stalled this auto-merge on every bump. An App-token PR fires
+#    `pull_request`/`pull_request_target` normally, so ci.yml runs on it and
+#    the `workflow_run: ci` path below merges once green. (See publish-dist.yml.)
 #
 #  - `workflow_dispatch`-triggered runs of `ci.yml` create check_runs that
 #    GitHub's branch-protection layer doesn't credit. By direct-merging via
@@ -31,9 +33,10 @@ on:
     workflows: ["ci"]
     types: [completed]
 
-  # Fires when the PR is opened by publish-dist. peter-evans's anti-
-  # recursion doesn't apply to pull_request_target. This is what kicks
-  # off Phase 1 (dispatch ci.yml against the branch).
+  # Fires when publish-dist opens the PR (now with the ak2k-ci App token, so
+  # the event is emitted). Phase 1 (dispatch ci.yml) is a redundant fallback
+  # now -- ci.yml already runs on the App-token PR via `pull_request` -- but
+  # harmless: it re-dispatches ci and Phase 2 merges on the first green check.
   pull_request_target:
     types: [opened, reopened]
     branches: [main]
diff --git a/.github/workflows/publish-dist.yml b/.github/workflows/publish-dist.yml
index 829067a..d01cf8e 100644
--- a/.github/workflows/publish-dist.yml
+++ b/.github/workflows/publish-dist.yml
@@ -58,9 +58,21 @@ jobs:
           mv dist-staged dist
           echo "${{ inputs.upstream_tag }}" > .last-processed
 
+      - name: Mint ak2k-ci App token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ secrets.CI_APP_ID }}
+          private-key: ${{ secrets.CI_APP_PRIVATE_KEY }}
+
       - name: Open PR
         uses: peter-evans/create-pull-request@v8
         with:
+          # Open the PR as the ak2k-ci App, NOT the default GITHUB_TOKEN.
+          # GITHUB_TOKEN-opened PRs emit no events, so ci.yml never ran on
+          # the auto-PR and auto-merge-publish-dist never fired. An App-token
+          # PR fires pull_request -> ci runs -> auto-merge merges when green.
+          token: ${{ steps.app-token.outputs.token }}
           branch: ce-lite/upstream-${{ inputs.upstream_tag }}
           title: "chore: convert CE ${{ inputs.upstream_tag }}"
           commit-message: "chore: convert CE ${{ inputs.upstream_tag }}"