From 55e2a5a4d59da04afebd1c09dc6cbce3349337f9 Mon Sep 17 00:00:00 2001 From: Kevin Veen-Birkenbach Date: Thu, 28 May 2026 12:47:49 +0200 Subject: [PATCH] fix(update): push update branches with the App installation token `actions/checkout` configures git's http.extraheader to authenticate as GITHUB_TOKEN, which update.yml scopes to `contents: read`. The subsequent `git push --force` in open_pr.sh therefore tripped 403 ("Permission to infinito-nexus/core.git denied to github-actions[bot]") even though the token-minting step had already produced an App installation token with `contents: write` in GH_TOKEN. Drop checkout's extraheader and rewrite origin's URL to embed GH_TOKEN as x-access-token before pushing, so the App's permissions actually reach the wire. Also pin two actionlint `-ignore` patterns in scripts/lint/action.sh to silence false positives for the `client-id` input on actions/create-github-app-token@v3 (the action's action.yml carries the input and marks `app-id` deprecated; actionlint 1.7.12's bundled schema lags behind the upstream release). Co-Authored-By: Claude Opus 4.7 --- scripts/github/update/open_pr.sh | 2 ++ scripts/lint/action.sh | 4 +++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/scripts/github/update/open_pr.sh b/scripts/github/update/open_pr.sh index 1b169c91b0..4d92cfe614 100755 --- a/scripts/github/update/open_pr.sh +++ b/scripts/github/update/open_pr.sh @@ -79,6 +79,8 @@ if [[ -n "${DUPLICATE_PR}" ]]; then exit 0 fi +git config --local --unset-all "http.https://github.com/.extraheader" 2>/dev/null || true +git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${REPO}.git" git push --force origin "${BRANCH}" PR_NUMBER="$( diff --git a/scripts/lint/action.sh b/scripts/lint/action.sh index 2aa82bcbf1..f9fbd8683a 100755 --- a/scripts/lint/action.sh +++ b/scripts/lint/action.sh @@ -8,4 +8,6 @@ REPO_ROOT="$(cd -- "${SCRIPT_DIR}/../.." && pwd)" cd "${REPO_ROOT}" -actionlint +actionlint \ + -ignore 'input "client-id" is not defined in action "actions/create-github-app-token' \ + -ignore 'missing input "app-id" which is required by action "actions/create-github-app-token'