doctor + pulp pr: surface missing RELEASE_BOT_TOKEN secret - #149
Merged
Conversation
Without RELEASE_BOT_TOKEN the auto-release workflow degrades silently: tags push via GITHUB_TOKEN, but GitHub deliberately doesn't trigger workflows on GITHUB_TOKEN-pushed tags (anti-infinite-loop), so release-cli.yml + sign-and-release.yml never fire and no GitHub Release appears. Hit this on v0.4.0 — wasted ~30 min figuring it out. Wire three nudges so the next person doesn't repeat that: - pulp doctor: new check 'RELEASE_BOT_TOKEN secret' probes the active repo's secrets via 'gh api repos/<slug>/actions/secrets'. Reports configured (with detail) or missing (with the exact 8-step fix recipe, including the repo's own slug and settings URL). Skipped silently when the repo can't be detected, gh isn't authed, or actions:read isn't granted (no false alarms). - pulp pr: prints a one-line yellow heads-up before the gates run if the secret is missing, pointing at pulp doctor and the docs guide. Doesn't block; gates and merge are unaffected. - docs/guides/versioning.md: 'One-time setup: RELEASE_BOT_TOKEN secret' section with the same 8-step PAT walkthrough plus the manual fallback (gh workflow run release-cli.yml --ref v<x.y.z>) for the case where the secret isn't set. - .agents/skills/ci/SKILL.md: short paragraph linking pulp doctor and the new docs section. Verified locally on this checkout: 'pulp doctor' shows 'RELEASE_BOT_TOKEN secret — configured on danielraffel/pulp ✓' and 'pulp pr --dry-run' prints no warning (because the secret IS set). Skill-Update: skip skill=cli-maintenance reason="Pure additive doctor + pr enhancement; no CLI-user-visible new invariants beyond the doctor row label, and the existing CLI invariants documented in cli-maintenance/SKILL.md still hold."
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a9e6a367c5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment on lines
+1595
to
+1597
| // Only emit a check if we got a usable response. | ||
| if (!secrets_list.empty()) { | ||
| DoctorCheck c{"RELEASE_BOT_TOKEN secret", false, {}, {}}; |
There was a problem hiding this comment.
This check only emits a DoctorCheck when secrets_list is non-empty, but --jq '.secrets[].name' returns an empty string when a repository has zero Actions secrets. In that common bootstrap case, pulp doctor will skip the RELEASE_BOT_TOKEN row entirely instead of reporting it as missing, so contributors still hit the silent post-merge release failure this change is meant to prevent.
Useful? React with 👍 / 👎.
| auto secrets = run_capture( | ||
| "gh api 'repos/" + repo + "/actions/secrets' " | ||
| "--jq '.secrets[].name' 2>/dev/null").stdout_text; | ||
| if (!secrets.empty() && secrets.find("RELEASE_BOT_TOKEN") == std::string::npos) { |
There was a problem hiding this comment.
The warning path requires !secrets.empty(), so pulp pr does not print any heads-up when a repo has zero Actions secrets even though RELEASE_BOT_TOKEN is definitely absent. That suppresses the new preflight warning in exactly the setup scenario where users need it most, and they only discover the problem after merge when release workflows do not fire.
Useful? React with 👍 / 👎.
danielraffel
added a commit
that referenced
this pull request
Apr 13, 2026
Codex P1 follow-ups on PR #149 — the bootstrap scenario where a repo genuinely has no secrets yet was exactly the case the new nudges were meant to catch, and the original implementations silently skipped it: - cli_common.cpp: the RELEASE_BOT_TOKEN doctor row used 'gh api ... --jq .secrets[].name' and gated on !secrets_list.empty(). Zero-secret repos produce empty stdout, so the row was omitted — identical to the 'gh errored' case. Now probes the raw JSON response (no --jq) and treats an empty response as 'gh errored' while a non-empty JSON body with no RELEASE_BOT_TOKEN match is the missing-secret signal we wanted to surface. - cmd_pr.cpp: same bug, same fix. The '!secrets.empty() && find == npos' guard suppressed the warning in the exact scenario users most need it. Also adds 'gh api --paginate' so repos with more than the default 30 secrets don't false-miss RELEASE_BOT_TOKEN on page 2+. Skill-Update: skip skill=cli-maintenance reason="Pure internal fixes to the just-shipped doctor + pulp pr flow; no CLI-user-visible interface change, and the existing 'pulp doctor' / 'pulp pr' / 'pulp version check' sections in cli-maintenance/SKILL.md still describe the right UX."
danielraffel
added a commit
that referenced
this pull request
Apr 14, 2026
…t re-drift (#152) * version: fix marketplace.json plugins[0].version drift; guard against re-drift plugins[0].version in .claude-plugin/marketplace.json was at 0.3.0 while plugin.json and the top-level marketplace version are at 0.4.0. The per-plugin entry is what Claude Code's marketplace listing surfaces, so it has to stay in lockstep with plugin.json's top-level version. The drift slipped in because 'pulp version check' only validated the top-level marketplace.json '.version' field — the nested plugins[0].version was invisible to the gate. Adding read_marketplace_plugin_entry_version() + a second equality check so this can't re-drift silently. Skill-Update: skip skill=cli-maintenance reason="One-line field add and one helper function — cli-maintenance/SKILL.md's existing 'pulp version check' section covers the multi-JSON-version-field gotcha generically; this commit just applies it to one more field of the same file." * doctor + pulp pr: don't silently skip when repo has zero Actions secrets Codex P1 follow-ups on PR #149 — the bootstrap scenario where a repo genuinely has no secrets yet was exactly the case the new nudges were meant to catch, and the original implementations silently skipped it: - cli_common.cpp: the RELEASE_BOT_TOKEN doctor row used 'gh api ... --jq .secrets[].name' and gated on !secrets_list.empty(). Zero-secret repos produce empty stdout, so the row was omitted — identical to the 'gh errored' case. Now probes the raw JSON response (no --jq) and treats an empty response as 'gh errored' while a non-empty JSON body with no RELEASE_BOT_TOKEN match is the missing-secret signal we wanted to surface. - cmd_pr.cpp: same bug, same fix. The '!secrets.empty() && find == npos' guard suppressed the warning in the exact scenario users most need it. Also adds 'gh api --paginate' so repos with more than the default 30 secrets don't false-miss RELEASE_BOT_TOKEN on page 2+. Skill-Update: skip skill=cli-maintenance reason="Pure internal fixes to the just-shipped doctor + pulp pr flow; no CLI-user-visible interface change, and the existing 'pulp doctor' / 'pulp pr' / 'pulp version check' sections in cli-maintenance/SKILL.md still describe the right UX."
This was referenced Apr 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Mirror of Shipyard #39 — same fix on the pulp side.
Why
Without `RELEASE_BOT_TOKEN`, auto-release degrades silently. Tags get pushed (via fallback to `GITHUB_TOKEN`), but GitHub Actions deliberately doesn't trigger workflows on `GITHUB_TOKEN`-pushed tags (anti-infinite-loop safety), so `release-cli.yml` and `sign-and-release.yml` never fire and no GitHub Release appears. We hit this on `v0.4.0` — wasted ~30 min.
What
Three nudges so the next person doesn't repeat that:
Verified locally
```
$ pulp doctor 2>&1 | grep RELEASE_BOT
✓ RELEASE_BOT_TOKEN secret — configured on danielraffel/pulp — auto-release tags will trigger release-cli.yml + sign-and-release.yml
```
(Pulp's repo does now have the secret set, so the row reports configured. On any repo without it, the row would show "missing" + the 8-step fix.)
Test plan