chore(bootstrap): pin e7126e4c274d and re-record digests - #79
Merged
Conversation
bdelanghe
added a commit
that referenced
this pull request
Jul 31, 2026
The `pin` job's first real run pushed a correct bump branch and then failed with "GitHub Actions is not permitted to create or approve pull requests". main went red on FRESHNESS with the fix sitting on an unopened branch, and the only trace of why was one line in a job log nobody was watching. #79 recovered it by hand. The setting is the real fix and a workflow cannot apply it. What changes here is the reporting: an ::error:: annotation naming the branch, the likely cause, that it is a settings fix rather than a code fix, and the manual recovery. Still exits 1 — main really is serving stale files to sessions without `.github` attached — but the red now says what to do. registry-graph.yml gets the same treatment: same copied pattern, same latent bug, and it has apparently never opened a PR in its life. Fixed before it fires. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This was referenced Aug 3, 2026
bdelanghe
added a commit
that referenced
this pull request
Aug 3, 2026
Two changes, one cause (#87). 1. Point at `front-desk-pin`, not `front-desk`. The fan-in entry carries no `contents`, so it could never push the bump branch, and it cannot be given any: it is deliberately unpinned and `contents` is privileged, so the broker would refuse the entry outright and take every other consumer with it. The separate pinned entry is bounded-systems/infra#172. 2. Do not use the token when the mint step FAILED. `require: contents, pull_requests` (#93) worked exactly as designed on the merge of #97 — it reported `contents(granted: absent)` and named both places the gap could live. Then `continue-on-error: true` swallowed the verdict, the job used the token anyway, and died on the very push the assertion had just said would fail. An assertion whose verdict nothing consumes is decoration. The fallback is not a downgrade: github.token holds contents:write here and pushed this branch fine before the broker was wired in (#79). So on a scope gap the branch now LANDS with the correct pin and only opening the PR is lost — a click, versus the full hand-regenerate it costs today (#79, #86, #89, #98). A third annotation separates "broker reachable, scopes insufficient" from "broker unreachable", since the two are fixed in different systems.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Generated by
org-defaults.yml'spinjob on the push of #77, which changedsession-start-dispatch.mjs— a fetched file — so the bootstrap pin no longer serves whatmaincontains. Until this lands, a session without.githubattached installs the older copy, andmainis red on FRESHNESS.The generator produced this correctly:
PIN→e7126e4c(#77's merge commit) and the newSUM_session_start_dispatch_mjs.node .claude/gen-bootstrap-pin.mjs --checkon this branch reportsok — e7126e4c274d serves what this tree contains.Opened by hand, because the job could not open it itself:
The branch push succeeded; only
gh pr createwas refused, because this repo (or the org) has Allow GitHub Actions to create and approve pull requests disabled. That is a settings fix, not a code fix, and it is tracked separately along with a code change so the job reports this cause instead of a bare GraphQL error.registry-graph.ymlhas the same latent bug — it copies the same pattern and would fail identically the first time the registry changes.Merging this should not produce another bump PR: the commit it lands as serves byte-identical fetched files, and the generator now writes only when the pin is wrong. That is the termination property from #78, and this is its first live test.
Generated by Claude Code