fix(update): push update branches with the App installation token

0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-10 04:36:40 +00:00

`actions/checkout` configures git's http.extraheader to authenticate
as GITHUB_TOKEN, which update.yml scopes to `contents: read`. The
subsequent `git push --force` in open_pr.sh therefore tripped 403
("Permission to infinito-nexus/core.git denied to github-actions[bot]")
even though the token-minting step had already produced an App
installation token with `contents: write` in GH_TOKEN.

Drop checkout's extraheader and rewrite origin's URL to embed
GH_TOKEN as x-access-token before pushing, so the App's permissions
actually reach the wire.

Also pin two actionlint `-ignore` patterns in scripts/lint/action.sh
to silence false positives for the `client-id` input on
actions/create-github-app-token@v3 (the action's action.yml carries
the input and marks `app-id` deprecated; actionlint 1.7.12's bundled
schema lags behind the upstream release).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

This commit is contained in:

kevinveenbirkenbachandClaude Opus 4.7 committed 2026-05-28 13:01:55 +02:00

1 parent f473b12888

commit 55e2a5a4d5

2 files changed

+5 -1

No files matched your search

									
										scripts/github/update/open_pr.sh
									
		+2
		
												View File
												
				@@ -79,6 +79,8 @@ if [[ -n "${DUPLICATE_PR}" ]]; then

					exit 0

				fi

				git config --local --unset-all "http.https://github.com/.extraheader" 2>/dev/null || true

				git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${REPO}.git"

				git push --force origin "${BRANCH}"

				PR_NUMBER="$(