Repository navigation
ci(auto-format): push and record success with the REPO_AUTOMATION_TOKEN PAT - #4797
Conversation
…EN PAT The workflow token can never write repository variables (the workflow permissions vocabulary has no such key — proven by probe dispatches, see #4787) and cannot push workflow files (#3118). A fine-grained PAT (developing-today-code-automation: Actions, Variables, Contents, Issues, Pull requests, commit statuses and Workflows read/write, Metadata read-only, this repo only, expires 2027-11-04) now lives in the REPO_AUTOMATION_TOKEN secret, with a copy in Bitwarden. Checkout and record_success use it; the workflow-file exclusion is gone since the PAT may push workflow files. Token verified end-to-end against the variables API before this change. The laptop-side variable sync stays as a backstop until an in-workflow record is observed.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 58 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. CodeRabbit Verify
|
Wires the auto-format pass to the new
REPO_AUTOMATION_TOKENsecret (fine-grained PATdeveloping-today-code-automation, scoped to this repo, expires 2027-11-04; copy in Bitwarden):record_successwritesAUTO_FORMAT_LAST_SUCCESS_SHAwith the PAT (the workflow token provably cannot — auto-format: scheduled runs not firing since the 15-minute redesign; record_success can never work with GITHUB_TOKEN (no variables permission scope) — laptop sync installed as the mechanism #4787);Token verified directly against the variables/repo/contents APIs (GET + PATCH all succeeded). The laptop-side variable sync remains as a backstop until the first in-workflow record is observed in a run log.
Refs #4787.
Open in [code]smith · Need help on this PR? Tag
@codesmith-botwith what you need.