fix(ci): create skills-sync PR with an App token so required CI runs#1597
Merged
Conversation
The daily "Update Copilot Skills" workflow opens its PR with the default GITHUB_TOKEN, so the caller's required on: pull_request checks never trigger and the PR (e.g. #1590) lands permanently blocked on missing required checks. Adopt the reusable workflow's use-app-token: true (supported since v4.0.1, the SHA already pinned here) with the org APP_PRIVATE_KEY secret, mirroring the fix already shipped for the plugins repo. Also correct the stale pin comment (the SHA resolves to v4.0.1, not v1.39.0+). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
devantler
added
automation
github_actions
Contributor
There was a problem hiding this comment.
Pull request overview
This PR fixes the “Update Copilot Skills” scheduled workflow so that the auto-created PR is opened using a GitHub App token (instead of GITHUB_TOKEN), ensuring the repository’s required CI workflows are triggered and required checks can report successfully.
Changes:
- Enable
use-app-token: truewhen calling theupdate-copilot-skillsreusable workflow. - Pass
APP_PRIVATE_KEYinto the reusable workflow to support GitHub App authentication. - Update the pinned reusable-workflow SHA comment to match the repo’s existing
# v4.0.1convention.
Contributor
|
🎉 This PR is included in version 1.2.3 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The daily Update Copilot Skills workflow (
update-skills.yaml) opens itsPR with the default
GITHUB_TOKEN. A PR created withGITHUB_TOKENdoes nottrigger the caller's
on: pull_request/pushCI, so the required statuschecks never report — the PR (currently #1590)
lands permanently
BLOCKEDon missing required checks and the skills neveractually sync. It shows only
CodeQL/Analyze (actions)succeeding (those runregardless), with the required CI absent.
Fix
Adopt the reusable workflow's
use-app-token: trueinput with the orgAPP_PRIVATE_KEYsecret (paired with the existingAPP_IDrepo variable). TheApp-token PR triggers CI normally, so required checks report and the PR can merge.
This mirrors the identical fix already shipped and merged for the plugins repo
(plugins#10) — platform was the
remaining un-migrated caller of the same reusable workflow. The pinned SHA
e173ff69is already v4.0.1, which supportsuse-app-token(added in v3.3.0),so no pin bump is needed. Platform already uses
secrets.APP_PRIVATE_KEYinsync-cluster-policies.yaml, so the credentials are available.Also corrected the stale/misleading pin comment (
# v1.39.0+ (post skills-lock refactor)→# v4.0.1) to match the actual pinned SHA and the convention used bythe other reusable-workflow callers in this repo (e.g.
release.yaml).Validation
actionlint .github/workflows/update-skills.yaml→ clean (exit 0). Additive andbackward-compatible; affects only how the scheduled skills-sync PR is created.
The change can't be exercised by this PR's own CI (the workflow is
schedule/dispatch-only) — the next scheduled run (or a
workflow_dispatch) willconfirm the resulting PR triggers required CI.