ci: publish tests with Maester Bot

[merill]

Summary

• Replace cpina/github-action-push-to-another-repository with official GitHub actions and explicit Git commands.
• Mint a short-lived Maester Bot installation token scoped to maester365/maester-tests with only contents: write.
• Checkout the destination repository with the scoped token, mirror tests/, and push only when the generated tree changed.
• Attribute synchronization commits to maester-bot[bot] and remove the workflow's dependency on the permanent SSH deploy key.

Why

The existing publishing action is no longer maintained for feature development and hides a small clone/copy/commit/push operation behind a third-party container. Maester already has a GitHub App with the required contents permission, so using its short-lived repository-scoped token reduces credential lifetime and makes the publishing behavior visible in this repository.

GitHub App access

The Maester Bot installation already includes maester365/maester-tests and grants code write access. The workflow further limits the minted token to that repository and contents: write.

After a successful manual publish-tests run, the now-unused SSH_DEPLOY_KEY repository secret can be removed separately.

Validation

• git diff --check
• Parsed .github/workflows/publish-tests.yaml successfully as YAML.
• Extracted the embedded publish script and validated it with bash -n.
• Exercised the mirror commands against a temporary read-only clone of maester365/maester-tests; the resulting destination tests/ tree exactly matched the source tree.
• No live push was attempted because this replacement workflow is not yet available on the default branch for workflow_dispatch.

Summary by CodeRabbit

• Chores
  • Improved automated publishing of test updates to the shared test repository.
  • Publishing now uses GitHub App authentication and updates the main branch directly.
  • Unchanged test content no longer creates unnecessary commits or pushes.
  • Test synchronization is now handled more consistently, helping keep shared test resources current.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: db68ebe9-b7d2-4d5a-925f-610cdc3bbe0e

📥 Commits

Reviewing files that changed from the base of the PR and between 700c5b5 and e0a1f94.

📒 Files selected for processing (1)

• .github/workflows/publish-tests.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/publish-tests.yaml

---

📝 Walkthrough

Walkthrough

The publishing workflow authenticates with a GitHub App, checks out maester365/maester-tests, synchronizes the local tests directory, and pushes changes to main only when changes exist.

Changes

Test repository publishing

Layer / File(s)	Summary
App authentication and repository checkout .github/workflows/publish-tests.yaml	The workflow generates a GitHub App token and checks out maester365/maester-tests with persisted write credentials.
Test synchronization and conditional publish .github/workflows/publish-tests.yaml	The workflow synchronizes the local tests directory, configures the bot identity, skips empty updates, and commits and pushes changes to main.

Estimated code review effort: 3 (Moderate) | ~15–30 minutes

Suggested labels: github_actions, automation

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CI workflow change and the use of the Maester Bot.
Description check	✅ Passed	The description explains the changes, rationale, permissions, validation, and follow-up action in a focused format.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/replace-cpina-with-maester-bot

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/publish-tests.yaml:
- Around line 89-90: Update the publishing workflow around the commit and git
push commands to handle concurrent publishers: either serialize runs that update
main or fetch the latest main, rebase the generated commit, and retry a
non-fast-forward push. Preserve the existing commit message and ensure the
workflow does not fail solely because another run advanced main first.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 59799328-1e14-45ff-836b-6b02d6a49e3c

📥 Commits

Reviewing files that changed from the base of the PR and between f3468e9 and 700c5b5.

📒 Files selected for processing (1)

• .github/workflows/publish-tests.yaml