fix(ci): create the icdc-core sync PR with the release bot token - #1261
Merged
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
This PR fixes the Update icdc-core workflow so that the automated sync pull request is created using the vici-release-bot GitHub App installation token (instead of the default GITHUB_TOKEN fallback), which allows downstream workflows (“Checks”) to run on the opened PR and avoids it being permanently blocked by ruleset-required checks.
Changes:
- Mint a
vici-release-botinstallation token viaactions/create-github-app-token(pinned) usingRELEASE_BOT_PRIVATE_KEY. - Use the minted app token when invoking the local
./.github/actions/create-prstep to open the sync PR.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
AntonioVentilii
force-pushed
the
av/fix-icdc-sync-pr-token
branch
from
August 19, 2026 18:00
aa138c8 to
1deafdf
Compare
AntonioVentilii
force-pushed
the
av/fix-icdc-sync-pr-token
branch
2 times, most recently
from
August 19, 2026 18:11
c9dc1fa to
cf6a117
Compare
AntonioVentilii
force-pushed
the
av/fix-icdc-sync-pr-token
branch
from
August 19, 2026 18:14
cf6a117 to
58c7c7c
Compare
AntonioVentilii
enabled auto-merge (squash)
August 19, 2026 18:28
AntonioVentilii
added a commit
that referenced
this pull request
Aug 19, 2026
# Motivation The snapshot PR on `main` was opened with `secrets.GITHUB_TOKEN`, which breaks it in two ways. PRs created with that token do not trigger workflow runs, so `bot-e2e-update-snapshots` never gets a `Checks` run and `checks-pass` never reports, leaving it blocked by the main ruleset. And since the move to the ViciApp org, `can_approve_pull_request_reviews` is `false` at both repo and org level, so the step now hard-fails outright with `GitHub Actions is not permitted to create or approve pull requests`. Same root cause and same fix as #1261, which covers `update-icdc-core.yml`. # Changes - The snapshot PR is now opened as the `vici-release-bot` GitHub App, matching `release-please.yml` and #1261. - The mint step carries the same `env.FINAL_CHANGES == 'true' && github.ref == 'refs/heads/main'` guard as the step that consumes it. This matters here in a way it did not in #1261: `finalize-snapshots-update` also runs for fork pull requests, where secrets are absent and `create-github-app-token` hard-fails on an empty private key. `refs/heads/main` is unreachable from a `pull_request` event, so that one condition is also the fork guard. - Dropped the note about the opened PR needing a manual nudge, which no longer applies. Left alone deliberately: the same-repo `add-and-commit` step keeps `GITHUB_TOKEN`. It pushes snapshots onto the PR head, and a token that retriggers workflows would let a snapshot-updating run push a commit that starts another snapshot-updating run. # Tests - `npx prettier --check .github/workflows/e2e.yml` passes. - `actionlint` before and after: identical output, so no new diagnostics. It exits 1 on both because of pre-existing info-level SC2086 notices elsewhere in the file. - Not verifiable pre-merge: the changed path only runs on `main` after a snapshot drift. The proof is the next drift opening a PR authored by `vici-release-bot` with a `Checks` run attached.
AntonioVentilii
added a commit
that referenced
this pull request
Aug 19, 2026
# Motivation The bot's app id was hardcoded as a bare `4594605` at every call site. It is now used well beyond releases (release-please, the dependabot lockfile fixup, and, once #1248 / #1261 / #1268 land, the format commit, the icdc-core sync and the e2e snapshot PR), so the literal was going to keep spreading with nothing tying the copies together or saying what the number is. # Changes - Both current call sites read `vars.PR_AUTOMATION_BOT_APP_ID` instead of the literal. The variable is already set on the repo, so this is inert on merge. - Named for what the bot actually does rather than for releases, since that is now the smaller half of its job. Not covered here, to avoid conflicting with open PRs that add their own call sites: `checks.yml` (#1248), `update-icdc-core.yml` (#1261) and `e2e.yml` (#1268). #1261 and #1268 already use the variable. #1248 still has the literal and wants a one-line follow-up once it merges. The private key secret is still `RELEASE_BOT_PRIVATE_KEY`. Renaming it means creating a new secret from the same key material and deleting the old one, which needs the key itself and so is not something this PR can do. # Tests - `npx prettier --check` on both files passes. - `actionlint` on both files exits 0 with no output. - `grep -rn 4594605 .github/` returns nothing on this branch. - The variable resolves: `gh api /repos/ViciApp/vici-app/actions/variables/PR_AUTOMATION_BOT_APP_ID` returns `4594605`.
AntonioVentilii
pushed a commit
that referenced
this pull request
Aug 20, 2026
🤖 I have created a release *beep* *boop* --- ## [1.8.38](v1.8.37...v1.8.38) (2026-08-20) ### Features * **frontend:** web2 auth path behind the backend-mode flag ([#1269](#1269)) ([f22c72b](f22c72b)) ### Bug Fixes * **backend:** align affiliations import conflict target with the tightened primary key ([#1246](#1246)) ([d710f1b](d710f1b)) * **backend:** regenerate bun.lock for the sharp 0.35.3 bump ([#1245](#1245)) ([d2838c7](d2838c7)) * **ci:** create the e2e snapshot PR with the release bot token ([#1268](#1268)) ([179d765](179d765)) * **ci:** create the icdc-core sync PR with the release bot token ([#1261](#1261)) ([db85174](db85174)) * **ci:** mint the app token the format job commits with ([#1248](#1248)) ([4dc92d1](4dc92d1)) ### Documentation * **ci:** keep the reason the lockfile job needs an app token ([#1273](#1273)) ([2071577](2071577)) ### Miscellaneous Chores * **ci:** read the bot app id from a repository variable ([#1270](#1270)) ([6fa55b6](6fa55b6)) * **deps:** bump sharp from 0.34.5 to 0.35.3 in /backend in the npm_and_yarn group across 1 directory ([#1242](#1242)) ([7c182f9](7c182f9)) * **github-actions:** bump junobuild/juno-action from 0.7.5.pre.full to 0.7.5 ([#1250](#1250)) ([23917aa](23917aa)) * **npm-deps-dev:** bump @sveltejs/vite-plugin-svelte from 7.2.0 to 7.3.0 ([#1260](#1260)) ([9716e2b](9716e2b)) * **npm-deps-dev:** bump @tailwindcss/vite from 4.3.2 to 4.3.3 ([#1266](#1266)) ([8015e5b](8015e5b)) * **npm-deps-dev:** bump @types/node from 26.1.1 to 26.2.0 ([#1263](#1263)) ([da2c5f6](da2c5f6)) * **npm-deps-dev:** bump tailwindcss from 4.3.2 to 4.3.3 ([#1267](#1267)) ([525c4c3](525c4c3)) * **npm-deps-dev:** bump tsx from 4.23.1 to 4.23.12 ([#1265](#1265)) ([c0bf443](c0bf443)) * **npm-deps-dev:** bump vite from 8.1.3 to 8.2.1 ([#1257](#1257)) ([43083f0](43083f0)) * **npm-deps:** bump @icp-sdk/signer from 5.4.0 to 5.6.2 ([#1264](#1264)) ([94b83fc](94b83fc)) * **npm-deps:** bump acorn from 8.17.0 to 8.18.0 ([#1262](#1262)) ([5c60d64](5c60d64)) * **npm-deps:** bump esrap from 2.2.13 to 2.3.5 ([#1259](#1259)) ([7d2eef3](7d2eef3)) ### Continuous Integration * **backend-deps:** regenerate bun.lock on backend dependabot PRs ([#1247](#1247)) ([6f6e06a](6f6e06a)) * **checks:** revert the dependabot mint skip from [#1275](#1275) ([#1276](#1276)) ([a69a561](a69a561)) * **checks:** skip app-token mint on dependabot runs ([#1275](#1275)) ([45eebd6](45eebd6)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: vici-release-bot[bot] <316991447+vici-release-bot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
update-icdc-core.ymlopened its sync PR withsecrets.RELEASE_PLEASE_PAT || secrets.GITHUB_TOKEN.RELEASE_PLEASE_PAThas never existed on this repo (gh secret listshows onlyRELEASE_BOT_PRIVATE_KEY,JUNO_TOKEN,FLY_API_TOKEN_WEB2_BACKEND,FLY_API_TOKEN_WEB2_WEB), so it always fell back toGITHUB_TOKEN. That breaks the workflow in two ways.First, a PR created with
GITHUB_TOKENdoes not trigger further workflow runs. #1202 has been open since 2026-08-03 with only the 3 CodeQL checks (those come from code scanning default setup, not fromChecks), sochecks-passnever reports and the main ruleset blocks it permanently.Second, since the move to the ViciApp org the workflow no longer opens a PR at all. The 2026-08-17 scheduled run pushed the branch and then failed with
GitHub Actions is not permitted to create or approve pull requests, becausecan_approve_pull_request_reviewsisfalseat both repo and org level.GITHUB_TOKENis subject to that restriction; a GitHub App installation token is not.Changes
vici-release-botGitHub App, using the sameactions/create-github-app-tokenstep and app id thatrelease-please.ymlalready uses. This fixes both failures: the app token can create PRs under the current org setting, and PRs it creates do triggerChecks. The installation demonstrably haspull-requests: writeandcontents: write, since release PR chore(release): v1.8.37 #1239 was authored byapp/vici-release-bot.formatjob inchecks.yml. This workflow only runs onscheduleandworkflow_dispatch, always frommain.Deliberately out of scope:
e2e.ymlpassessecrets.GITHUB_TOKENto the samecreate-praction forbot-e2e-update-snapshots, so it hits the identical pair of problems and now hard-fails on the org setting. The same fix applies, but that path is only reachable onmainafter an e2e snapshot drift and deserves its own PR.Tests
grep -rn RELEASE_PLEASE_PAT .github/returns no matches.npx prettier --check .github/workflows/update-icdc-core.ymlpasses.actionlinton the file before and after the change: both exit 0 with empty output, so no new diagnostics.schedule/workflow_dispatch. The proof is a post-mergeworkflow_dispatchopening a PR authored byvici-release-botwith aChecksrun attached.