chore: commit generated references with GitHub App by marandaneto · Pull Request #546 · PostHog/posthog-python

marandaneto · 2026-04-30T09:28:39Z

💡 Motivation and Context

The generated references workflow was failing when trying to push directly to main with github-actions[bot], because repository rules require verified commits and PR/ruleset checks.

References are only needed after releases, so this removes the standalone manual generate-references.yml workflow and generates/commits references inline in the already-approved release job. The commit now uses the same GitHub App token and planetscale/ghcommit-action flow used by the release workflow, avoiding a second environment approval.

💚 How did you test it?

Parsed .github/workflows/release.yml as YAML locally.
Ran git diff --check.

📝 Checklist

I reviewed the submitted code.
I added tests to verify the changes.
I updated the docs if needed.
No breaking change or entry added to the changelog.

If releasing new changes

Ran sampo add to generate a changeset file
Added the release label to the PR

socket-security · 2026-04-30T09:29:45Z

No dependency changes detected. Learn more about Socket for GitHub.

👍 No dependency changes detected in pull request

greptile-apps · 2026-04-30T09:30:07Z

Security Review

actions/create-github-app-token@v3 in .github/workflows/generate-references.yml uses a mutable tag rather than a pinned SHA. This action produces the token used to commit directly to main; all other actions in both workflow files are SHA-pinned. Risk is low given the trusted actions org, but pinning is recommended for consistency and supply-chain hygiene.

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
.github/workflows/generate-references.yml:16
**Unpinned action version**

`actions/create-github-app-token@v3` uses a mutable tag while every other action in both workflow files is pinned to a full commit SHA. This action produces the token used to write directly to `main`, so a tag mutation (however unlikely from the official `actions` org) would affect a highly privileged step. Pin it to a specific SHA for consistency and defence in depth.

(replace `@v3` with the actual SHA for that tag)

_{Reviews (1): Last reviewed commit: "chore: commit generated references with ..." | Re-trigger Greptile}

github-actions · 2026-04-30T09:31:53Z

posthog-python Compliance Report

Date: 2026-04-30 10:11:53 UTC
Duration: 160014ms

✅ All Tests Passed!

30/30 tests passed

Capture Tests

✅ 29/29 tests passed

View Details

Test	Status	Duration
Format Validation.Event Has Required Fields	✅	517ms
Format Validation.Event Has Uuid	✅	1507ms
Format Validation.Event Has Lib Properties	✅	1507ms
Format Validation.Distinct Id Is String	✅	1506ms
Format Validation.Token Is Present	✅	1507ms
Format Validation.Custom Properties Preserved	✅	1506ms
Format Validation.Event Has Timestamp	✅	1507ms
Retry Behavior.Retries On 503	✅	9514ms
Retry Behavior.Does Not Retry On 400	✅	3510ms
Retry Behavior.Does Not Retry On 401	✅	3506ms
Retry Behavior.Respects Retry After Header	✅	9514ms
Retry Behavior.Implements Backoff	✅	23517ms
Retry Behavior.Retries On 500	✅	7512ms
Retry Behavior.Retries On 502	✅	7515ms
Retry Behavior.Retries On 504	✅	7513ms
Retry Behavior.Max Retries Respected	✅	23528ms
Deduplication.Generates Unique Uuids	✅	1496ms
Deduplication.Preserves Uuid On Retry	✅	7511ms
Deduplication.Preserves Uuid And Timestamp On Retry	✅	14524ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry	✅	7508ms
Deduplication.No Duplicate Events In Batch	✅	1503ms
Deduplication.Different Events Have Different Uuids	✅	1507ms
Compression.Sends Gzip When Enabled	✅	1507ms
Batch Format.Uses Proper Batch Structure	✅	1506ms
Batch Format.Flush With No Events Sends Nothing	✅	1005ms
Batch Format.Multiple Events Batched Together	✅	1505ms
Error Handling.Does Not Retry On 403	✅	3509ms
Error Handling.Does Not Retry On 413	✅	3507ms
Error Handling.Retries On 408	✅	7513ms

Feature_Flags Tests

✅ 1/1 tests passed

View Details

Test	Status	Duration
Request Payload.Request With Person Properties Device Id	✅	514ms

marandaneto · 2026-04-30T09:32:43Z

        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh workflow run generate-references.yml --ref main
+          GITHUB_TOKEN: ${{ steps.releaser.outputs.token }}


we need this to live here because of the GH token, otherwise it'd require a 2nd environment approval

marandaneto · 2026-04-30T09:32:54Z

https://github.com/PostHog/posthog-python/actions/runs/25156855061/job/73740806572

ioannisj · 2026-04-30T09:48:04Z

-      - name: Dispatch generate-references
+      - name: Generate references
        if: steps.commit-release.outputs.commit-hash != ''
+        run: |


Do we need a continue on error for these next steps? Low context from me here but if the package is released and externally visible I think we should not fail. Plus previous impl was just dispatching to another workflow so any failures were isolated there and did not affect this one

i dont disagree but this is exactly what happened before
generate references was failing and we didnt notice for quite a while

Could this be a warning message on slack?

since this is executed after release, github release etc the release will work anyway, and if references failed, we can just fix forward

yes, its gonna be a failed release, so the slack thread gets updated, we know that it partly failed, fix forward and thats it

we can change if this often fails and its breaking releases
we tried the other way, we had this broken for a few weeks, now we try the other way

# Conflicts: # .github/workflows/generate-references.yml

ioannisj

Approving anw to unblock

chore: commit generated references with GitHub App

c188f85

marandaneto requested a review from a team as a code owner April 30, 2026 09:28

greptile-apps Bot reviewed Apr 30, 2026

View reviewed changes

Comment thread .github/workflows/generate-references.yml Outdated

chore: remove standalone references workflow

2ca23ef

marandaneto commented Apr 30, 2026

View reviewed changes

marandaneto enabled auto-merge (squash) April 30, 2026 09:33

ioannisj reviewed Apr 30, 2026

View reviewed changes

Merge branch 'main' into chore/use-ghcommit-for-references

557e284

# Conflicts: # .github/workflows/generate-references.yml

ioannisj approved these changes Apr 30, 2026

View reviewed changes

marandaneto merged commit b490908 into main Apr 30, 2026
26 checks passed

marandaneto deleted the chore/use-ghcommit-for-references branch April 30, 2026 10:12

Conversation

marandaneto commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💡 Motivation and Context

💚 How did you test it?

📝 Checklist

If releasing new changes

Uh oh!

socket-security Bot commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented Apr 30, 2026

Security Review

Uh oh!

Uh oh!

github-actions Bot commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

posthog-python Compliance Report

✅ All Tests Passed!

Capture Tests

Feature_Flags Tests

Uh oh!

marandaneto Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

marandaneto commented Apr 30, 2026

Uh oh!

ioannisj Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

marandaneto Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

ioannisj Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

marandaneto Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

marandaneto Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

marandaneto Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

ioannisj left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

marandaneto commented Apr 30, 2026 •

edited

Loading

socket-security Bot commented Apr 30, 2026 •

edited

Loading

github-actions Bot commented Apr 30, 2026 •

edited

Loading