Skip to content

chore: Remove PR_TOKEN from build workflows#30402

Merged
Cal-L merged 2 commits into
mainfrom
chore/remove-pr-token-on-builds
May 19, 2026
Merged

chore: Remove PR_TOKEN from build workflows#30402
Cal-L merged 2 commits into
mainfrom
chore/remove-pr-token-on-builds

Conversation

@Cal-L

@Cal-L Cal-L commented May 19, 2026

Copy link
Copy Markdown
Contributor

Description

Since PR_TOKEN is rolled by Patroll every 30 mins, the team has been encountering step failures especially post token roll. This PR removes PR_TOKEN from workflows that do not need it, stabilizing workflows such as Nightly builds and uploading build to testflight. We'll rely on github.token instead for branch checkout + deletion steps.

Example failures-

@Cal-L - Once this PR is merged into main, we'll verify that the workflows do not need PR_TOKEN and further remove PR_TOKEN dependencies as needed

Changelog

CHANGELOG entry:

Related issues

Fixes: https://consensyssoftware.atlassian.net/browse/MCWP-613

Manual testing steps

Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]

Screenshots/Recordings

Before

After

Pre-merge author checklist

Performance checks (if applicable)

  • I've tested on Android
    • Ideally on a mid-range device; emulator is acceptable
  • I've tested with a power user scenario
    • Use these power-user SRPs to import wallets with many accounts and tokens
  • I've instrumented key operations with Sentry traces for production performance metrics

For performance guidelines and tooling, see the Performance Guide.

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Note

Medium Risk
Moderate risk because it changes authentication/permissions used by CI workflows that create and delete ephemeral build branches, which could break nightly/TestFlight pipelines if github.token lacks required access in some contexts.

Overview
Removes reliance on the rotating PR_TOKEN in build-related GitHub Actions by switching checkouts in branch-creation and cleanup jobs to use github.token instead.

Also makes the PR_TOKEN secret optional in update-latest-build-version.yml (while still falling back to github.token for checkout/push), reducing required secret wiring for callers.

Reviewed by Cursor Bugbot for commit fb7d7a1. Bugbot is set up for automated code reviews on this repo. Configure here.

@Cal-L Cal-L requested review from a team as code owners May 19, 2026 18:13
@github-actions

Copy link
Copy Markdown
Contributor

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@Cal-L Cal-L added no-changelog no-changelog Indicates no external facing user changes, therefore no changelog documentation needed no changelog required No changelog entry is required for this change labels May 19, 2026
@metamaskbotv2 metamaskbotv2 Bot added the team-mobile-platform Mobile Platform team label May 19, 2026
@Cal-L Cal-L added No QA Needed Apply this label when your PR does not need any QA effort. needs-dev-review PR needs reviews from other engineers (in order to receive required approvals) labels May 19, 2026
@github-project-automation github-project-automation Bot moved this to Needs dev review in PR review queue May 19, 2026

@cursor cursor Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 4a2744c. Configure here.

Comment thread .github/workflows/update-latest-build-version.yml Outdated
@sonarqubecloud

Copy link
Copy Markdown

@github-project-automation github-project-automation Bot moved this from Needs dev review to Review finalised - Ready to be merged in PR review queue May 19, 2026
@Cal-L Cal-L merged commit 2386387 into main May 19, 2026
104 checks passed
@Cal-L Cal-L deleted the chore/remove-pr-token-on-builds branch May 19, 2026 20:40
@github-project-automation github-project-automation Bot moved this from Review finalised - Ready to be merged to Merged, Closed or Archived in PR review queue May 19, 2026
@github-actions github-actions Bot locked and limited conversation to collaborators May 19, 2026
@github-actions github-actions Bot removed the needs-dev-review PR needs reviews from other engineers (in order to receive required approvals) label May 19, 2026
@metamaskbotv2 metamaskbotv2 Bot added the release-7.79.0 Issue or pull request that will be included in release 7.79.0 label May 19, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

no changelog required No changelog entry is required for this change No QA Needed Apply this label when your PR does not need any QA effort. no-changelog no-changelog Indicates no external facing user changes, therefore no changelog documentation needed release-7.79.0 Issue or pull request that will be included in release 7.79.0 size-XS team-mobile-platform Mobile Platform team

Projects

Archived in project

Development

Successfully merging this pull request may close these issues.

2 participants