From d8c67f035f2412d6897eca1942f40e0c6afaa5eb Mon Sep 17 00:00:00 2001 From: scanner Date: Sat, 10 Oct 2026 20:26:18 -0400 Subject: [PATCH] ci: open meeting-recordings refresh PR with App token when provisioned Signed-off-by: scanner --- .github/workflows/meeting-recordings-refresh.yml | 16 ++++++++++++++++ ...d-296-meeting-recordings-refresh-app-token.md | 4 ++++ 2 files changed, 20 insertions(+) create mode 100644 changelog.d/changed-296-meeting-recordings-refresh-app-token.md diff --git a/.github/workflows/meeting-recordings-refresh.yml b/.github/workflows/meeting-recordings-refresh.yml index 23a30ab3..0bf25d82 100644 --- a/.github/workflows/meeting-recordings-refresh.yml +++ b/.github/workflows/meeting-recordings-refresh.yml @@ -15,6 +15,9 @@ jobs: pull-requests: write runs-on: ubuntu-latest timeout-minutes: 10 + env: + # `secrets.*` is not allowed in `if:`; expose presence via env instead. + HAS_APP_SECRETS: ${{ secrets.MEETING_REFRESH_APP_ID != '' && secrets.MEETING_REFRESH_APP_PRIVATE_KEY != '' }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: @@ -29,9 +32,22 @@ jobs: cache: npm - run: npm ci --ignore-scripts - run: npx tsx scripts/update-meeting-recordings.ts + - name: Mint App token so the PR triggers pull_request workflows + id: app-token + # Until MEETING_REFRESH_APP_ID / MEETING_REFRESH_APP_PRIVATE_KEY are + # provisioned this step is skipped and the PR falls back to GITHUB_TOKEN. + if: env.HAS_APP_SECRETS == 'true' + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + app-id: ${{ secrets.MEETING_REFRESH_APP_ID }} + private-key: ${{ secrets.MEETING_REFRESH_APP_PRIVATE_KEY }} - name: Open PR with recording feed snapshot uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: + # PRs created with GITHUB_TOKEN never get pull_request runs, so Build and + # npm audit silently never report on the head SHA (#293, #296). Use the + # App token when provisioned; fall back to GITHUB_TOKEN until then. + token: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }} signoff: true branch: automation/meeting-recordings-refresh delete-branch: true diff --git a/changelog.d/changed-296-meeting-recordings-refresh-app-token.md b/changelog.d/changed-296-meeting-recordings-refresh-app-token.md new file mode 100644 index 00000000..7a70da1d --- /dev/null +++ b/changelog.d/changed-296-meeting-recordings-refresh-app-token.md @@ -0,0 +1,4 @@ +- The daily meeting-recordings refresh PR is now opened with a GitHub App + token when `MEETING_REFRESH_APP_ID` / `MEETING_REFRESH_APP_PRIVATE_KEY` are + provisioned, so `Lint and build` and `npm audit` run on its head SHA + (hivecommons/docs#296). Until then it falls back to `GITHUB_TOKEN`.