From 5d1449d27ec8f330bfe43446bd0422efc476a6c2 Mon Sep 17 00:00:00 2001 From: Aiden Cline <63023139+rekram1-node@users.noreply.github.com> Date: Thu, 30 Jul 2026 23:08:39 -0500 Subject: [PATCH] chore(ci): use OpenCode app credentials for ci-fixer and model sync (#3887) * chore(ci): use OpenCode app credentials for fixer PRs Mint GitHub App tokens for ci-fixer and issue-fixer so opened PRs trigger CI and can be auto-merged, matching the opencode repo pattern. * chore(ci): app credentials for ci-fixer and model sync only Keep issue-fixer on GITHUB_TOKEN. Use the OpenCode app for ci-fixer and sync-models so their PRs trigger CI. * fix(ci): keep GITHUB_TOKEN for sync issue creation Missing-model issues must be opened with GITHUB_TOKEN so issues.opened does not fire; Issue Fixer is started only via repository_dispatch. Use the app token only when reporting/pushing catalog PRs. --- .../actions/setup-git-committer/action.yml | 43 +++++++++++++++++++ .github/workflows/ci-fixer.yml | 25 +++++++++-- .github/workflows/sync-models.yml | 12 ++++-- 3 files changed, 74 insertions(+), 6 deletions(-) create mode 100644 .github/actions/setup-git-committer/action.yml diff --git a/.github/actions/setup-git-committer/action.yml b/.github/actions/setup-git-committer/action.yml new file mode 100644 index 000000000..65c974c6a --- /dev/null +++ b/.github/actions/setup-git-committer/action.yml @@ -0,0 +1,43 @@ +name: "Setup Git Committer" +description: "Create app token and configure git user" +inputs: + opencode-app-id: + description: "OpenCode GitHub App ID" + required: true + opencode-app-secret: + description: "OpenCode GitHub App private key" + required: true +outputs: + token: + description: "GitHub App token" + value: ${{ steps.apptoken.outputs.token }} + app-slug: + description: "GitHub App slug" + value: ${{ steps.apptoken.outputs.app-slug }} +runs: + using: "composite" + steps: + - name: Create app token + id: apptoken + uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 + with: + app-id: ${{ inputs.opencode-app-id }} + private-key: ${{ inputs.opencode-app-secret }} + owner: ${{ github.repository_owner }} + + - name: Configure git user + run: | + slug="${{ steps.apptoken.outputs.app-slug }}" + git config --global user.name "${slug}[bot]" + git config --global user.email "${slug}[bot]@users.noreply.github.com" + shell: bash + + - name: Clear checkout auth + run: | + git config --local --unset-all http.https://github.com/.extraheader || true + shell: bash + + - name: Configure git remote + run: | + git remote set-url origin https://x-access-token:${{ steps.apptoken.outputs.token }}@github.com/${{ github.repository }} + shell: bash diff --git a/.github/workflows/ci-fixer.yml b/.github/workflows/ci-fixer.yml index ee15d1ded..3f0112d16 100644 --- a/.github/workflows/ci-fixer.yml +++ b/.github/workflows/ci-fixer.yml @@ -28,14 +28,23 @@ jobs: runs-on: ubuntu-latest env: GH_REPO: ${{ github.repository }} - GH_TOKEN: ${{ github.token }} FAILED_RUN_ID: ${{ github.event.workflow_run.id }} FAILED_RUN_URL: ${{ github.event.workflow_run.html_url }} FAILED_WORKFLOW: ${{ github.event.workflow_run.name }} steps: + - name: Create app token + id: apptoken + uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 + with: + app-id: ${{ vars.OPENCODE_APP_ID }} + private-key: ${{ secrets.OPENCODE_APP_SECRET }} + owner: ${{ github.repository_owner }} + - name: Check run budget id: budget + env: + GH_TOKEN: ${{ steps.apptoken.outputs.token }} run: | set -euo pipefail @@ -92,6 +101,15 @@ jobs: uses: actions/checkout@v4 with: ref: dev + persist-credentials: false + + - name: Setup git committer + id: committer + if: steps.budget.outputs.run == 'true' && steps.budget-cache.outputs.cache-hit != 'true' + uses: ./.github/actions/setup-git-committer + with: + opencode-app-id: ${{ vars.OPENCODE_APP_ID }} + opencode-app-secret: ${{ secrets.OPENCODE_APP_SECRET }} - name: Install opencode if: steps.budget.outputs.run == 'true' && steps.budget-cache.outputs.cache-hit != 'true' @@ -99,6 +117,8 @@ jobs: - name: Collect failed logs if: steps.budget.outputs.run == 'true' && steps.budget-cache.outputs.cache-hit != 'true' + env: + GH_TOKEN: ${{ steps.committer.outputs.token }} run: | set -euo pipefail LOG_FILE="$RUNNER_TEMP/dev-ci-failure.log" @@ -159,6 +179,7 @@ jobs: - name: Create pull request if: steps.budget.outputs.run == 'true' && steps.budget-cache.outputs.cache-hit != 'true' env: + GH_TOKEN: ${{ steps.committer.outputs.token }} BRANCH: ci-fixer-${{ github.event.workflow_run.id || github.run_id }} TITLE: "fix: dev CI failure" run: | @@ -169,8 +190,6 @@ jobs: exit 0 fi - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" git switch -c "$BRANCH" git add -A git commit -m "$TITLE" diff --git a/.github/workflows/sync-models.yml b/.github/workflows/sync-models.yml index a9b9cd8a4..f52656138 100644 --- a/.github/workflows/sync-models.yml +++ b/.github/workflows/sync-models.yml @@ -51,6 +51,14 @@ jobs: uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 with: ref: dev + persist-credentials: false + + - name: Setup git committer + id: committer + uses: ./.github/actions/setup-git-committer + with: + opencode-app-id: ${{ vars.OPENCODE_APP_ID }} + opencode-app-secret: ${{ secrets.OPENCODE_APP_SECRET }} - name: Setup Bun uses: oven-sh/setup-bun@f4d14e03ff726c06358e5557344e1da148b56cf7 @@ -88,7 +96,7 @@ jobs: - name: Report changes env: - GH_TOKEN: ${{ github.token }} + GH_TOKEN: ${{ steps.committer.outputs.token }} BRANCH: automation/sync-models-${{ matrix.provider }} LABELS: automation,model-sync,provider:${{ matrix.provider }} TITLE: "chore(sync): update ${{ matrix.name }} model catalog" @@ -107,8 +115,6 @@ jobs: exit 0 fi - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" git fetch --no-tags --depth=1 origin "+refs/heads/$BRANCH:refs/remotes/origin/$BRANCH" || true git checkout -B "$BRANCH" git add models providers