[hivecommons-hive]

What

The meeting-recordings refresh workflow now mints a GitHub App token (actions/create-github-app-token v3.2.0, SHA verified) and passes it to peter-evans/create-pull-request (token: steps.app-token.outputs.token || secrets.GITHUB_TOKEN). PRs opened with GITHUB_TOKEN never get pull_request runs, so Lint and build / npm audit never reported on the head SHA (#293). Also adds a changelog fragment.

Safe to merge now

The App-token step only runs when MEETING_REFRESH_APP_ID and MEETING_REFRESH_APP_PRIVATE_KEY exist (presence exposed via job-level env, since secrets.* is not allowed in if:). Until then it is skipped and GITHUB_TOKEN is used, so nothing changes until the secrets are provisioned.

After secrets are provisioned

The next scheduled refresh PR should show Lint and build + npm audit check-runs on its head SHA.

Refs #296 (needs-human: maintainer must provision MEETING_REFRESH_APP_ID / MEETING_REFRESH_APP_PRIVATE_KEY and confirm the next refresh PR shows Build + npm audit check-runs)

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[netlify]

✅ Deploy Preview for hivecommons-docs ready!

Name	Link
🔨 Latest commit	d8c67f0
🔍 Latest deploy log	https://app.netlify.com/projects/hivecommons-docs/deploys/6acad7be3d7cf70008d7a922
😎 Deploy Preview	https://deploy-preview-305--hivecommons-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[hivecommons-hive]

d8c67f0

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head d8c67f035f24) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/meeting-recordings-refresh.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

hive/awaiting-ci: CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: d8c67f0

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Evidence bundle `#305d8c67f0` sha256:cc172e1ba9857a518404e37cc1c667b20b83d27563fe43bd88feec6f540344ee — download from the dashboard or `hivectl review evidence #305`.