ci(backport): open backport PRs with the cozystack-ci App token - #3896
Draft
myasnikovdaniil wants to merge 1 commit into
Draft
ci(backport): open backport PRs with the cozystack-ci App token#3896myasnikovdaniil wants to merge 1 commit into
myasnikovdaniil wants to merge 1 commit into
Conversation
Backport PRs opened by the bot sat waiting for a maintainer to click
"Approve and run workflows" before any check would start. Nine were
parked that way on 2026-08-18, and nothing surfaces them, so the
backports that carry fixes to the release lines were the ones sitting
still.
The cause is not this workflow but the repository's policy:
GET /repos/cozystack/cozystack/actions/permissions/fork-pr-contributor-approval
{"approval_policy":"all_external_contributors"}
github-actions[bot] is external under that policy, so every run
triggered by a PR it authors lands in action_required, even though the
branch is same-repo (isCrossRepository: false). An org-installed App is
not an external contributor. #3550, opened by cozystack-ci[bot] through
this same App token, drew its full check set unapproved, including a
54-minute E2E job.
So mint the App token and hand it to backport-action, matching the
pattern already used by retention, cut-prerelease, promote-rc, tags,
pull-requests and pull-requests-release. Same action pin and the same
owner: cozystack as the other ten call sites.
Scope worth being precise about: backport-action documents github_token
as "used to create and label pull requests and to comment", so this
moves PR authorship and nothing else. The git push still runs on the
credentials actions/checkout persists, so a backport carrying a
.github/workflows/ change is still rejected, and that stays true until
the App is granted workflows: write -- a permission that would let
anything able to trigger the App rewrite CI and reach every secret, and
one this change deliberately does not ask for.
The token step is gated on the same already_merged guard as the two
steps around it, so a backport the guard has already decided against
mints no credential. That makes three gated steps where the contract
test counted exactly two; it now counts three, and the count still
fails if any single gate is dropped.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Contributor
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport PRs opened by bot wait for maintainer to click "Approve and run workflows" before any check starts. Nine of them were parked like that today and nothing surfaces them, so backports carrying fixes to release lines are exactly the ones sitting still.
Reason is not in this workflow but in repo policy:
github-actions[bot] is external under that policy, so every run triggered by PR it authors lands in action_required, even when branch is same-repo. Org installed App is not external contributor. #3550 was opened by cozystack-ci[bot] with this same App token and got full check set without any approval, including 54 minutes e2e job.
So this PR mints App token and passes it to backport-action, same as retention, cut-prerelease, promote-rc, tags, pull-requests and pull-requests-release already do. Same action pin and same
owner: cozystackas other ten call sites.This moves only PR authorship. backport-action documents
github_tokenas "used to create and label pull requests and to comment", git push still uses credentials that actions/checkout persists, so backport carrying.github/workflows/change is still rejected. That needsworkflows: writeon the App and I don't ask for it here, App able to rewrite CI can reach every secret, and hand-porting those is rare (#3893, #3894).Token step gated on same already_merged guard as two steps around it, so backport that guard already rejected mints no credential. That makes three gated steps where contract test counted exactly two, so count updated to three. It still fails if any single gate dropped.
#3844 edits same file and is open, whichever lands second needs rebase.