From 4f5beb1f7d948a0b09cb3643255f0b66fe91f5b1 Mon Sep 17 00:00:00 2001 From: Andrew Anderson Date: Mon, 19 Oct 2026 11:50:50 -0400 Subject: [PATCH] =?UTF-8?q?=F0=9F=8C=B1=20ci:=20run=20lint/build=20for=20m?= =?UTF-8?q?eeting-recordings=20refresh=20PRs=20without=20a=20GitHub=20App?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PRs pushed/opened with GITHUB_TOKEN never get pull_request runs, so the required checks (Lint and build, TypeScript & ESLint, Run unit tests, Audit production dependencies) never landed on the refresh PR head and it could not merge. Instead of provisioning a GitHub App and two secrets, the refresh job now dispatches build/typecheck/vitest/npm-audit on the PR branch via workflow_dispatch (allowed from GITHUB_TOKEN); those runs report check-runs on the head SHA and satisfy branch protection. Removes the create-github-app-token fallback machinery. Signed-off-by: Andrew Anderson --- .github/workflows/build.yml | 4 ++ .../workflows/meeting-recordings-refresh.yml | 55 +++++++++++++------ .github/workflows/npm-audit.yml | 3 + .github/workflows/typecheck.yml | 4 ++ .github/workflows/vitest.yml | 4 ++ ...-meeting-recordings-refresh-dispatch-ci.md | 6 ++ 6 files changed, 59 insertions(+), 17 deletions(-) create mode 100644 changelog.d/changed-335-meeting-recordings-refresh-dispatch-ci.md diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index dffa5bf..eb28f4a 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -5,6 +5,10 @@ on: branches: [main] push: branches: [main] + # Dispatched by meeting-recordings-refresh.yml: PRs it opens with GITHUB_TOKEN + # never get pull_request runs, so it triggers this workflow on the PR branch + # instead (#335, #337). + workflow_dispatch: permissions: contents: read diff --git a/.github/workflows/meeting-recordings-refresh.yml b/.github/workflows/meeting-recordings-refresh.yml index d454a27..b532cc0 100644 --- a/.github/workflows/meeting-recordings-refresh.yml +++ b/.github/workflows/meeting-recordings-refresh.yml @@ -8,16 +8,21 @@ on: permissions: contents: read +env: + REFRESH_BRANCH: automation/meeting-recordings-refresh + # Workflows whose jobs are the required status checks on main. Each must + # declare `on: workflow_dispatch` so this run can trigger them on the PR + # branch (see "Trigger required checks" below). + REQUIRED_CHECK_WORKFLOWS: build.yml typecheck.yml vitest.yml npm-audit.yml + jobs: refresh: permissions: + actions: write # dispatch the CI workflows on the PR branch contents: write pull-requests: write runs-on: ubuntu-latest timeout-minutes: 10 - env: - # `secrets.*` is not allowed in `if:`; expose presence via env instead. - HAS_APP_SECRETS: ${{ secrets.MEETING_REFRESH_APP_ID != '' && secrets.MEETING_REFRESH_APP_PRIVATE_KEY != '' }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: @@ -32,24 +37,19 @@ jobs: cache: npm - run: npm ci --ignore-scripts - run: npx tsx scripts/update-meeting-recordings.ts - - name: Mint App token so the PR triggers pull_request workflows - id: app-token - # Until MEETING_REFRESH_APP_ID / MEETING_REFRESH_APP_PRIVATE_KEY are - # provisioned this step is skipped and the PR falls back to GITHUB_TOKEN. - if: env.HAS_APP_SECRETS == 'true' - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 - with: - app-id: ${{ secrets.MEETING_REFRESH_APP_ID }} - private-key: ${{ secrets.MEETING_REFRESH_APP_PRIVATE_KEY }} - name: Open PR with recording feed snapshot + id: pr uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: - # PRs created with GITHUB_TOKEN never get pull_request runs, so Build and - # npm audit silently never report on the head SHA (#293, #296). Use the - # App token when provisioned; fall back to GITHUB_TOKEN until then. - token: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }} + # Pushes and PRs made with GITHUB_TOKEN never create pull_request + # runs (#293, #296, #335, #337). Rather than requiring a GitHub App + # and two extra secrets, the step below dispatches the CI workflows + # on the PR branch; workflow_dispatch runs *are* allowed from + # GITHUB_TOKEN and report check-runs on the branch head SHA, which + # satisfies the required status checks on main. + token: ${{ secrets.GITHUB_TOKEN }} signoff: true - branch: automation/meeting-recordings-refresh + branch: ${{ env.REFRESH_BRANCH }} delete-branch: true add-paths: data/meeting-recordings.json commit-message: "docs: refresh community meeting recordings" @@ -57,7 +57,28 @@ jobs: body: | Automated daily refresh of `data/meeting-recordings.json`. + This PR was opened with `GITHUB_TOKEN`, so GitHub does not start + `pull_request` workflows for it. The refresh run instead dispatches + Build, TypeScript & Lint Check, Vitest and npm audit on the PR + branch; their check-runs land on the head SHA as usual. + + Refresh run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} + The hive sweep merges this PR once CI is green. + - name: Trigger required checks on the PR branch + # Only after the branch was (re)pushed; a no-op refresh has nothing new + # to verify and would just re-run the same checks on the same SHA. + if: steps.pr.outputs.pull-request-operation == 'created' || steps.pr.outputs.pull-request-operation == 'updated' + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + HEAD_SHA: ${{ steps.pr.outputs.pull-request-head-sha }} + run: | + set -euo pipefail + echo "Dispatching required checks on $REFRESH_BRANCH @ $HEAD_SHA" + for wf in $REQUIRED_CHECK_WORKFLOWS; do + gh workflow run "$wf" --repo "$GITHUB_REPOSITORY" --ref "$REFRESH_BRANCH" + echo " dispatched $wf" + done - name: Trigger Netlify rebuild if: env.NETLIFY_BUILD_HOOK_URL != '' env: diff --git a/.github/workflows/npm-audit.yml b/.github/workflows/npm-audit.yml index 2937c50..a6a9867 100644 --- a/.github/workflows/npm-audit.yml +++ b/.github/workflows/npm-audit.yml @@ -7,6 +7,9 @@ on: branches: [main] schedule: - cron: "41 5 * * 1" + # Also dispatched by meeting-recordings-refresh.yml: PRs it opens with + # GITHUB_TOKEN never get pull_request runs, so it triggers this workflow on + # the PR branch instead (#335, #337). workflow_dispatch: permissions: diff --git a/.github/workflows/typecheck.yml b/.github/workflows/typecheck.yml index 4978802..13360eb 100644 --- a/.github/workflows/typecheck.yml +++ b/.github/workflows/typecheck.yml @@ -5,6 +5,10 @@ on: branches: [main] push: branches: [main] + # Dispatched by meeting-recordings-refresh.yml: PRs it opens with GITHUB_TOKEN + # never get pull_request runs, so it triggers this workflow on the PR branch + # instead (#335, #337). + workflow_dispatch: permissions: read-all # default read; writes scoped to job below diff --git a/.github/workflows/vitest.yml b/.github/workflows/vitest.yml index b398087..3d239b1 100644 --- a/.github/workflows/vitest.yml +++ b/.github/workflows/vitest.yml @@ -5,6 +5,10 @@ on: branches: [main] push: branches: [main] + # Dispatched by meeting-recordings-refresh.yml: PRs it opens with GITHUB_TOKEN + # never get pull_request runs, so it triggers this workflow on the PR branch + # instead (#335, #337). + workflow_dispatch: permissions: read-all # default read; writes scoped to job below diff --git a/changelog.d/changed-335-meeting-recordings-refresh-dispatch-ci.md b/changelog.d/changed-335-meeting-recordings-refresh-dispatch-ci.md new file mode 100644 index 0000000..a2beb09 --- /dev/null +++ b/changelog.d/changed-335-meeting-recordings-refresh-dispatch-ci.md @@ -0,0 +1,6 @@ +- The daily meeting-recordings refresh workflow no longer needs a GitHub App + (`MEETING_REFRESH_APP_ID` / `MEETING_REFRESH_APP_PRIVATE_KEY`). After pushing + the PR branch it dispatches Build, TypeScript & Lint Check, Vitest and npm + audit on that branch via `workflow_dispatch`, so the required status checks + land on the head SHA even though the PR is opened with `GITHUB_TOKEN` + (hivecommons/docs#335, hivecommons/docs#337).