0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-08 11:46:35 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 4.7 0b5672d7d5 ci(update): mint GitHub App token so update PRs trigger full CI

Workflow-driven update PRs opened with GITHUB_TOKEN do not start
further workflow runs, so the CI orchestrator never executed against
them. Each PR-opening job in update.yml now mints a short-lived
GitHub App installation token via actions/create-github-app-token@v2
and forwards APP_SLUG to open_update_pr.sh, which derives the
verified-commit identity from the App user.

The job-level permissions block drops to read-only since write access
is provided exclusively by the App token. Behaviour with the secrets
unset is fail-loud: the token step fails, the PR step is skipped,
and no PR with an unintended identity is ever created.

Requires the BOT_APP_ID and BOT_APP_PRIVATE_KEY repository secrets
documented in docs/contributing/tools/github/actions/secrets.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-20 00:50:25 +02:00

actions

ci(update): mint GitHub App token so update PRs trigger full CI

2026-05-20 00:50:25 +02:00

branch

feat(ci): add CI_RUN_ON_MAIN gate, reorg actions docs

2026-04-18 16:31:52 +02:00

README.md

feat(ci): add CI_RUN_ON_MAIN gate, reorg actions docs

2026-04-18 16:31:52 +02:00

repository.md

test(tooling): integrate markdownlint-cli2, ansible-lint, galaxy-importer + fix the resulting baseline

2026-05-08 23:46:37 +02:00

README.md

GitHub governance guides 🛡️

This directory contains contributor guidance for GitHub governance and repository controls. Its scope is branch protection, repository settings, GitHub Actions workflows and variables, and other platform rules that affect contributions.