mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 4.7
0b5672d7d5
Workflow-driven update PRs opened with GITHUB_TOKEN do not start further workflow runs, so the CI orchestrator never executed against them. Each PR-opening job in update.yml now mints a short-lived GitHub App installation token via actions/create-github-app-token@v2 and forwards APP_SLUG to open_update_pr.sh, which derives the verified-commit identity from the App user. The job-level permissions block drops to read-only since write access is provided exclusively by the App token. Behaviour with the secrets unset is fail-loud: the token step fails, the PR step is skipped, and no PR with an unintended identity is ever created. Requires the BOT_APP_ID and BOT_APP_PRIVATE_KEY repository secrets documented in docs/contributing/tools/github/actions/secrets.md. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
8 lines
385 B
Markdown
8 lines
385 B
Markdown
# GitHub Actions guides 🎬
|
|
|
|
This directory documents GitHub Actions in this repository.
|
|
|
|
- [workflows.md](workflows.md): catalog of every workflow file under `.github/workflows/`.
|
|
- [configuration.md](configuration.md): repository variables that control CI behaviour.
|
|
- [secrets.md](secrets.md): repository secrets that workflows consume, and the failure mode when they are missing.
|