Conversation
It's needed to run Actions after merging.
There was a problem hiding this comment.
Pull Request Overview
This PR modifies the CI checker workflow to use a GitHub App token instead of the default GITHUB_TOKEN for merging pull requests. This change enables Actions to run after the merge operation, which the default token cannot trigger due to GitHub's security restrictions.
- Adds GitHub App token creation step with necessary permissions
- Updates the merge step to use the App token instead of
GITHUB_TOKEN
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
WalkthroughAdds a step in the CI workflow to generate a GitHub App token and switches the PR merge step to use this token instead of GITHUB_TOKEN. No other workflow changes. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/ci-checker.yml (1)
36-44: Make the inputs a bit more explicit (owner + vars).
- Prefer storing the numeric App ID in repository/org variables and reference it via vars.
- Explicitly setting owner reduces ambiguity if the App is installed in multiple owners.
Apply:
- app-id: ${{ secrets.APP_ID }} + app-id: ${{ vars.APP_ID }} private-key: ${{ secrets.PRIVATE_KEY }} + owner: ${{ github.repository_owner }}
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/ci-checker.yml(1 hunks)
🔇 Additional comments (3)
.github/workflows/ci-checker.yml (3)
36-44: Good switch to an App token with least-privilege and a pinned action SHA.
- Using actions/create-github-app-token pinned to a commit is supply-chain safe.
- The permission-* inputs are valid and correctly scope the installation token to contents and PRs. (github.com)
36-44: Confirm App installation and granted permissions.Ensure the GitHub App is installed on this repository and that its installation actually has contents: write and pull_requests: write; otherwise the step will error when requesting these permissions. (github.com)
48-48: Using the App token for GH CLI will allow post-merge workflows to run.GITHUB_TOKEN-initiated events (e.g., push from a merge) don’t start new workflow runs, but actions performed with a GitHub App token do. This change achieves the goal of “run Actions after merging.” (docs.github.com)
close #
✏️ Description
It's needed to run Actions after merging.