Fix newsletter workflow auth so buttondown_id commit succeeds#409
Merged
Conversation
…ceeds
The `Commit buttondown_id updates` step has been failing on every push
to main since 2026-06-05 13:42 UTC. The publish step is fine — it
successfully creates the Buttondown draft. The failure is the `git push`
back to main: the default GITHUB_TOKEN is not a bypass actor on the
main-branch ruleset, so the push gets rejected.
The net effect is that each push to main (every "Sync syndication state"
commit landed today) re-publishes the same newsletter as a fresh draft,
then fails to commit the id back, guaranteeing the next push does it
again. Ep 3 has been duplicated as a Buttondown draft for every run since
the regression landed.
Match the auth pattern already used by `bluesky.yml`, which pushes
syndication state back to main successfully:
- Mint a token via `actions/create-github-app-token` (the GitHub App
is the configured bypass actor on the ruleset).
- Pass that token to `actions/checkout` so subsequent `git push` uses
it.
- Check out `ref: main` rather than the trigger SHA, so a queued run
sees the freshest frontmatter.
- `git pull --rebase origin main` before push to absorb any commits
that landed during the workflow run.
- Add `concurrency: newsletter-publish` (cancel-in-progress: false) so
two pushes can't race the same unpublished file through publish and
double-create the draft.
Tests: add two regression tests against the buttondown frontmatter
parser. The first covers the exact shape sync writes onto disk — title,
date, `is_newsletter: true`, plus the new `subtitle`, `atproto_uri`,
`atproto_pub_cid`, and `publication` fields from PRs #404-#408 — and
asserts it deserializes with no `buttondown_id`. The second covers the
blank-line-after-`---` layout the sync tool produces on `weekly/20260407/
index.md`. These pin down the user's hypothesis that something in the
new frontmatter shape broke serde — confirming it does not.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
CI Lint job failed `cargo fmt --check` on the test_parse_frontmatter_blank_lines_between_delimiter_and_first_key literal. Applied `cargo fmt` to wrap. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
coreyja
approved these changes
Jun 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
Publish Newsletterworkflow has been failing on every push tomainsince 2026-06-05 13:42 UTC. The failure is not in the publish step — that succeeds and creates the Buttondown draft. The failure is the trailingCommit buttondown_id updatesstep: the defaultGITHUB_TOKENisn't a bypass actor on the main-branch ruleset, sogit pushis rejected.Net effect: every push to main yesterday (every
Sync syndication statecommit) re-published ep3 as a fresh draft, failed to commit the id back, and the next push did it again. Ep 3 (blog/weekly/20260407/index.md) accumulated ~50 duplicate Buttondown drafts.Fix
Mirror the GitHub-App-token pattern already used by
.github/workflows/bluesky.yml:actions/create-github-app-token(the App is the configured ruleset bypass actor).actions/checkoutso subsequent git ops use it.ref: mainrather than the trigger SHA so a queued run sees the freshest frontmatter.git pull --rebase origin mainbefore push to absorb any commits landed during the run.concurrency: newsletter-publish(cancel-in-progress: false) so two pushes can't race the same unpublished file through publish and double-create the draft.Tests
Two regression tests on
commands::buttondown::parse_frontmattercovering the newsubtitle/atproto_uri/atproto_pub_cid/publicationfields from PRs #404-#408 — confirming serde is not the regression. All 25 buttondown tests pass; clippy clean (-D warnings).Followup not in this PR
~50 duplicate ep3 Buttondown drafts to clean up manually. Once this PR merges, the next push triggers the workflow, publishes ep3 one more time (51st), and the commit-back finally lands the
buttondown_idso subsequent runs short-circuit.Test plan
blog/weekly/20260407/index.mdends up withbuttondown_id:via auto-commit🤖 Generated with Claude Code