mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 11:46:35 +00:00
kevinveenbirkenbachandClaude Opus 4.7
0b5672d7d5
Workflow-driven update PRs opened with GITHUB_TOKEN do not start further workflow runs, so the CI orchestrator never executed against them. Each PR-opening job in update.yml now mints a short-lived GitHub App installation token via actions/create-github-app-token@v2 and forwards APP_SLUG to open_update_pr.sh, which derives the verified-commit identity from the App user. The job-level permissions block drops to read-only since write access is provided exclusively by the App token. Behaviour with the secrets unset is fail-loud: the token step fails, the PR step is skipped, and no PR with an unintended identity is ever created. Requires the BOT_APP_ID and BOT_APP_PRIVATE_KEY repository secrets documented in docs/contributing/tools/github/actions/secrets.md. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
GitHub Workflow Helpers 🔧
This directory holds the GitHub workflow helper scripts that the workflows under .github/workflows/ call.
For the repository Make target index, see make.md.
Entry Points 📋
| Script | What it does | Used by |
|---|---|---|
cancel_deleted_branch_runs.sh |
Cancels active workflow runs for a deleted branch. | .github/workflows/delete-branch.yml |
cancel_pull_request_runs.sh |
Cancels active workflow runs for a closed pull request. | .github/workflows/cancel-pull-request-runs.yml |
check_git_changes.sh |
Emits a changed=true/false workflow output based on git diff. |
.github/workflows/update.yml |
install_update_python.sh |
Installs Python dependencies needed by the automated update workflows. | .github/workflows/update.yml |
open_update_pr.sh |
Commits update changes, pushes the branch, and creates or refreshes the matching Pull Request. | .github/workflows/update.yml |
update/image_versions.sh |
Runs the Docker image version updater CLI from GitHub Actions. | .github/workflows/update.yml |
update/repository_refs.sh |
Runs the git repository ref updater CLI from GitHub Actions. | .github/workflows/update.yml |