infra: switch sync-motoko to pr-automation-bot-public GitHub App#197
Merged
infra: switch sync-motoko to pr-automation-bot-public GitHub App#197
Conversation
Replace GITHUB_TOKEN (with elevated permissions) with the pr-automation-bot-public app token for all authenticated operations: - Add create-github-app-token step (app-id + private-key from org vars/secrets) - Remove job-level contents: write + pull-requests: write permissions - Configure git remote URL with app token before git push - Use app token for gh release view and gh pr create Closes #196
The git push uses implicit checkout credentials (dfinity org defaults GITHUB_TOKEN to read-write for contents). Only gh pr create needs the explicit app token via GH_TOKEN. Matches the pattern in dfinity/icskills sync-upstream.yml.
ggreif
reviewed
May 5, 2026
….1.1 app-id is deprecated in actions/create-github-app-token in favour of client-id. Update the input name and bump the pin to v3.1.1 (1b10c78c), which is the version that formalised this change.
Member
Author
|
Feedback addressed:
Note: this assumes |
Member
Author
|
needs confirmation of @basvandijk that |
|
I just created |
raymondk
approved these changes
May 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Switches the
Motoko release checkworkflow from usingGITHUB_TOKENwith elevated permissions to thepr-automation-bot-publicGitHub App, as required now that the repo is public.Changes to
.github/workflows/sync-motoko.yml:permissions: contents: write / pull-requests: write— no longer needed when using the app tokenactions/create-github-app-tokenstep (usingvars.PR_AUTOMATION_BOT_PUBLIC_APP_IDandsecrets.PR_AUTOMATION_BOT_PUBLIC_PRIVATE_KEY) immediately after checkoutgit push, so branch creation is authenticated via the botsecrets.GITHUB_TOKENusages withsteps.app-token.outputs.token(gh release viewandgh pr create)Closes #196
Next steps after merge
Trigger the
Motoko release checkworkflow manually viaworkflow_dispatchto verify the bot creates the PR correctly for the pending Motoko v1.7.0 sync.Sync recommendation
hand-written