Repository navigation
Run the merge gate and reconciler as simtabi-bot, scoped per job - #7
Merged
Merged
Conversation
bot/policy.json names each job's permissions, owners and repositories; the bot-token action refuses anything it does not name and passes the rest to create-github-app-token. A job with no permissions is a load error, because no permission inputs would mean every permission the app holds. The key is an environment secret here only. The reconciler keeps Refresh Bot's credentials until the bot's client ID is set, so it does not stop in between. The merge gate still skips with a notice until the app exists.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves this control repository to
simtabi-bot(defined in imanimanyara/github-appsfeat/simtabi-bot).bot/policy.json: each job's permissions, owners and repositories. Owners*means the orgs independabot/policy.json; client accounts are refused whatever the policy says..github/actions/bot-token: resolves the job withbot/resolve.pyand passes exactly those permissions toactions/create-github-app-token. Unknown jobs and owners are refused. A job with no permissions fails to load, because no permission inputs would mean every permission the app holds.dependabot-merge.yml: runs assimtabi-botin thesimtabi-botenvironment; still skips with a notice until the app's credentials exist.dependabot-reconcile.yml: usessimtabi-botonceSIMTABI_BOT_CLIENT_IDis set, and Refresh Bot until then, choosing both halves of the credential pair on that one condition. It keeps running in between.bot/README.md, and the Dependabot README's credentials section.Safe to merge before the app exists: the merge gate skips, and the reconciler falls back.
Checks run locally:
bot/tests(13 pass) anddependabot/tests(13 pass); actionlint 1.7.12 clean. Both new guards were broken on purpose and went red: the action/ceiling match and the workflow-job-exists check.