Repository navigation
fix(ci): push the regenerate-lockfiles branch as the App - #7355
Merged
mitsudome-r merged 1 commit intoOct 16, 2026
Merged
mitsudome-r merged 1 commit into
mitsudome-r merged 1 commit into
Conversation
The checkout step of the open-pr job kept the GITHUB_TOKEN credentials. So git push ran as github-actions[bot], which the branch-creation rulesets block. Do not persist these credentials, so that the push uses the App token from gh auth setup-git. Signed-off-by: Mete Fatih Cırıt <mfc@autoware.org>
Contributor
|
Thank you for contributing to the Autoware project! 🚧 If your pull request is in progress, switch it to draft mode. Please ensure:
|
xmfcx
marked this pull request as ready for review
October 15, 2026 03:12
xmfcx
requested review from
isamu-takagi,
mitsudome-r,
oguzkaganozt and
youtalk
as code owners
October 15, 2026 03:12
mitsudome-r
approved these changes
Oct 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The
open-prjob ofregenerate-lockfiles.yamlcannot push its branch. This PR fixes it.The fix adds
persist-credentials: falseto the🛒 Check out repositorystep of theopen-prjob. It changes nothing else.regenerate-lockfiles.yaml#L116-L117The cause
Run 38670168549 regenerated all four lockfiles. Then its
open-prjob failed atgit pushwith this error:open-prjobThe push did not run as the App:
awf-autoware-botApp (id 153766). This App is in the bypass list of the branch rulesets.gh auth setup-gitwith this token, and runsgit push.actions/checkoutkeeps its credentials by default. The log of the checkout step showspersist-credentials: true, and the step setshttp.https://github.com/.extraheader AUTHORIZATION: basic ***withGITHUB_TOKEN.github-actions[bot](App 15368), which has no bypass. Git never uses the credential helper ofgh auth setup-git.With
persist-credentials: false, the checkout sets no header. Thengit pushuses the App token throughgh auth setup-git. Thegh pr createstep already uses the App token throughGH_TOKEN.No ruleset change is necessary.
How was this PR tested?
See Verification below.
AI usage
AI usage: Written with Claude Code in Breeze, from the log of the failed run 38670168549.
Self-review: One review round by a separate AI session with a clean context, on
1ceff85. It found no blocker. It confirmed the cause with the run log, the App ids, and the ruleset bypass list. It also found that no step ofopen-prbefore the push needs the checkout credentials.Verification: Only `pre-commit` ran on the changed file, and all hooks passed. The fixed workflow did not run yet.
pre-commit run --files .github/workflows/regenerate-lockfiles.yamlcheck yaml,prettier, andyamllintpassed. The other hooks passed or skipped.actionlint, because it is not installed on this host.workflow_dispatchrun onmainafter the merge shows the result.