[Changelog]Use isaaclab-bot GitHub App token for nightly changelog push by hujc7 · Pull Request #5527 · isaac-sim/IsaacLab

hujc7 · 2026-05-07T05:45:01Z

Why

Develop's branch ruleset requires 18 status checks and 1 approval before any push. The nightly compile workflow (#5482) was authenticated with GITHUB_TOKEN (identity github-actions[bot]), which has neither the bypass entitlement nor a way to satisfy approvals. Result: the cron pushed cleanly until it hit develop, then failed with protected branch hook declined — fragments accumulate, no auto-bump happens.

Confirmed failure: https://github.com/isaac-sim/IsaacLab/actions/runs/25419200769

What this PR does

Switches the workflow's checkout/push token to a short-lived installation access token minted from the isaaclab-bot GitHub App (created by @kellyguo11 and added to develop's ruleset bypass list).

Change	Effect
Add `actions/create-github-app-token@v3.1.1` step (SHA-pinned)	Mints a 1-hour installation token from `CHANGELOG_APP_ID` + `CHANGELOG_APP_PRIVATE_KEY` repo secrets.
`actions/checkout` token: `app-token` instead of `GITHUB_TOKEN`	Push is signed by `isaaclab-bot[bot]` — the bypass identity. Lands without satisfying required-checks / required-approval.
`git config user.{name,email}` updated to `isaaclab-bot[bot]`	Auto-commits attribute to the bot user in the GitHub UI.
Workflow `permissions: contents: write` → `contents: read`	The App token carries write access; `GITHUB_TOKEN` only needs read. Tightens least-privilege.
Header comment rewritten	Documents the App-token model + bypass requirement.

Side benefit: triggers downstream workflows

GITHUB_TOKEN-signed pushes don't trigger downstream workflows by design (loop guard). App-token-signed pushes are treated as external pushes and DO trigger downstream CI — so docs / Docker rebuild jobs fire on the auto-commit naturally, no separate PAT required.

Setup status

Already done by maintainers:

isaaclab-bot GitHub App created with contents: write permission
App installed on isaac-sim/IsaacLab
App added to develop's ruleset bypass actor list
Repo secrets CHANGELOG_APP_ID and CHANGELOG_APP_PRIVATE_KEY set

Test plan

PR diff is YAML-only, no code changes.
After merge: manually trigger via gh workflow run "Nightly Changelog Compilation" --repo isaac-sim/IsaacLab and verify the push lands and the bot user shows as the commit author on https://github.com/isaac-sim/IsaacLab/commits/develop.
Confirm the next 5 AM UTC cron sweeps the accumulated fragment backlog (~22 fragments at last count).

cc @kellyguo11

GitHub branch protection on develop requires 18 status checks AND 1 approval before any push. The default GITHUB_TOKEN identifies as github-actions[bot], which is not on the bypass list, so the auto- commit gets rejected (run 25419200769 confirmed this). Switch the workflow to mint a short-lived installation access token for the isaaclab-bot GitHub App (set up by Kelly and added to the bypass-actor list of develop's ruleset). Now the push is signed as isaaclab-bot[bot] — which IS bypass-eligible — and lands directly. App token also has the side effect of triggering downstream workflows on the auto-commit (GITHUB_TOKEN does not), so docs / Docker rebuilds fire normally. Requires two repo secrets to be set: - CHANGELOG_APP_ID — the App's numeric ID - CHANGELOG_APP_PRIVATE_KEY — the App's PEM private key Reduces the workflow's GITHUB_TOKEN scope from contents:write to contents:read, since write access now comes from the App token. Pin actions/create-github-app-token to v3.1.1 (1b10c78c7865c340bc4f6099eb2f838309f1e8c3) per the SHA-pin convention.

greptile-apps · 2026-05-07T05:49:05Z

Greptile Summary

This PR replaces the nightly changelog workflow's push authentication from a GITHUB_TOKEN/CHANGELOG_PAT fallback chain with a short-lived GitHub App installation credential minted from isaaclab-bot, which is on develop's branch-ruleset bypass list — resolving the protected branch hook declined failures that blocked the auto-commit.

App token step added (actions/create-github-app-token@v3.1.1, SHA-pinned): mints a 1-hour installation credential before checkout; the token is scoped to the current repository only (default when owner and repositories inputs are omitted), and checkout passes it along so all subsequent git push calls are signed as isaaclab-bot[bot].
Permissions tightened: workflow-level contents permission dropped from write to read since the App credential carries its own write access; git commit author updated to match the bot identity (282401363+isaaclab-bot[bot]@users.noreply.github.com).
Downstream CI side-effect: App-credential-signed pushes are treated as external pushes by GitHub, so Docker/docs rebuild jobs fire naturally without a separate PAT.

Confidence Score: 4/5

Safe to merge; the YAML-only change correctly threads the App credential through checkout and push, and the permission reduction is a net improvement.

The core flow is sound and the SHA-pinned action is correctly configured. The removal of the previous graceful fallback is the one area worth a second look — a misconfigured App or deleted credential now aborts the entire job before checkout, silently piling up changelog fragments until someone notices the cron failures.

.github/workflows/nightly-changelog.yml — focus on the new create-github-app-token step and whether a credential-minting failure should abort or degrade gracefully.

Important Files Changed

Filename	Overview
.github/workflows/nightly-changelog.yml	Switches nightly changelog push auth from GITHUB_TOKEN/PAT fallback to a GitHub App installation token; reduces workflow-level GITHUB_TOKEN permissions to read-only; updates git commit author identity to `isaaclab-bot[bot]`.

Sequence Diagram

sequenceDiagram
    participant Cron as Cron / workflow_dispatch
    participant Runner as GitHub Actions Runner
    participant AppAction as create-github-app-token action
    participant BotApp as isaaclab-bot GitHub App
    participant Checkout as actions/checkout
    participant Branch as develop branch

    Cron->>Runner: Trigger nightly-changelog workflow
    Runner->>AppAction: App ID + Private Key credentials
    AppAction->>BotApp: Request 1-hour installation access credential
    BotApp-->>AppAction: Installation access credential (1h TTL)
    AppAction-->>Runner: Credential stored as step output
    Runner->>Checkout: "ref=develop, using bot credential"
    Checkout->>Branch: git clone with full history
    Runner->>Runner: Compile changelog fragments via cli.py
    alt Fragments exist and not dry-run
        Runner->>Runner: git commit as isaaclab-bot[bot]
        Runner->>Branch: git push origin HEAD:develop
        Note over Branch: Bot is bypass actor - no review gates required
        Branch-->>Runner: Push accepted
        Runner->>Runner: Downstream CI triggered naturally
    else No fragments or dry-run mode
        Runner->>Runner: Skip commit and push
    end

_{Reviews (1): Last reviewed commit: "Mint isaaclab-bot App token for nightly ..." | Re-trigger Greptile}

F1: Declare permission-contents: write on the App-token mint step so a misconfigured App fails the mint loudly rather than silently degrading to a push-time error 30 seconds later. F2: Rebase onto develop before pushing, so a human commit landing on develop during the ~2-minute job window doesn't reject the auto-push. F3: Use boolean ${{ !inputs.dry_run }} instead of string compare against 'true'. The string form worked due to GitHub Actions coercion, but the boolean form is type-correct.

@kellyguo11

…sh (isaac-sim#5527) Develop's branch ruleset requires 18 status checks **and** 1 approval before any push. The nightly compile workflow (isaac-sim#5482) was authenticated with `GITHUB_TOKEN` (identity `github-actions[bot]`), which has neither the bypass entitlement nor a way to satisfy approvals. Result: the cron pushed cleanly until it hit develop, then failed with `protected branch hook declined` — fragments accumulate, no auto-bump happens. Confirmed failure: https://github.com/isaac-sim/IsaacLab/actions/runs/25419200769 Switches the workflow's checkout/push token to a short-lived installation access token minted from the `isaaclab-bot` GitHub App (created by @kellyguo11 and added to develop's ruleset bypass list). | Change | Effect | |---|---| | Add `actions/create-github-app-token@v3.1.1` step (SHA-pinned) | Mints a 1-hour installation token from `CHANGELOG_APP_ID` + `CHANGELOG_APP_PRIVATE_KEY` repo secrets. | | `actions/checkout` token: `app-token` instead of `GITHUB_TOKEN` | Push is signed by `isaaclab-bot[bot]` — the bypass identity. Lands without satisfying required-checks / required-approval. | | `git config user.{name,email}` updated to `isaaclab-bot[bot]` | Auto-commits attribute to the bot user in the GitHub UI. | | Workflow `permissions: contents: write` → `contents: read` | The App token carries write access; `GITHUB_TOKEN` only needs read. Tightens least-privilege. | | Header comment rewritten | Documents the App-token model + bypass requirement. | `GITHUB_TOKEN`-signed pushes don't trigger downstream workflows by design (loop guard). App-token-signed pushes are treated as external pushes and DO trigger downstream CI — so docs / Docker rebuild jobs fire on the auto-commit naturally, no separate PAT required. Already done by maintainers: - [x] `isaaclab-bot` GitHub App created with `contents: write` permission - [x] App installed on `isaac-sim/IsaacLab` - [x] App added to develop's ruleset bypass actor list - [x] Repo secrets `CHANGELOG_APP_ID` and `CHANGELOG_APP_PRIVATE_KEY` set - [x] PR diff is YAML-only, no code changes. - [ ] After merge: manually trigger via `gh workflow run "Nightly Changelog Compilation" --repo isaac-sim/IsaacLab` and verify the push lands and the bot user shows as the commit author on https://github.com/isaac-sim/IsaacLab/commits/develop. - [ ] Confirm the next 5 AM UTC cron sweeps the accumulated fragment backlog (~22 fragments at last count). cc @kellyguo11

@kellyguo11

The first successful run of https://github.com/isaac-sim/IsaacLab/actions/workflows/nightly-changelog.yml after #5527 merged surfaced two non-blocking deprecation warnings (https://github.com/isaac-sim/IsaacLab/actions/runs/25531103473). This PR clears both. ## Changes | File | Change | Why | |---|---|---| | `.github/workflows/nightly-changelog.yml` | `app-id: ${{ secrets.CHANGELOG_APP_ID }}` → `client-id: ${{ secrets.CHANGELOG_APP_CLIENT_ID }}` | `actions/create-github-app-token@v3` deprecated the integer `app-id` input. Switching to `client-id` (the OAuth `Iv23...` string) is the supported path going forward. | | same | `actions/setup-python@v5` → `@v6.2.0` (SHA-pinned) | `v5` ships as a Node 20 action. GitHub will force it to Node 24 on 2026-06-02 and remove Node 20 entirely on 2026-09-16. `v6.2.0`'s release notes call out Node 24 compatibility explicitly. | ## Setup - Repo secret `CHANGELOG_APP_CLIENT_ID` is already set (the App's Client ID from https://github.com/organizations/isaac-sim/settings/apps/isaaclab-bot). - Existing `CHANGELOG_APP_ID` secret is now unreferenced — safe to delete in repo settings whenever, kept for now. - `CHANGELOG_APP_PRIVATE_KEY` unchanged. ## Test plan - [x] YAML-only change, no logic touched. - [ ] After merge: trigger via `gh workflow run "Nightly Changelog Compilation" --repo isaac-sim/IsaacLab` and verify (a) the run succeeds and (b) the deprecation warnings are gone from the run log. cc @kellyguo11

# Description Merge changes from main branch: - #4875 - Adds Isaac-Stack-Cube-Franka-IK-Rel-v0 task variants - #4909 - Updates minor RSL-RL configclass docstring - #4934 - Updates Newton docs on main for 3.0 beta changes - #5182 - Fix flatdict version pin to allow 4.1.0+ - #5195 - Add NCCL troubleshooting notes - #5406 - Updates doc building job on main to match develop - #5311 - Update skrl integration for version 2.0.0 - #5482 - Adds nightly-changelog.yml on main - #5527 - Use isaaclab-bot GitHub App token for nightly changelog push - #5537 - Address deprecation warnings in nightly changelog workflow - #5746 - Fix .dockerignore for _isaac_sim symlink - #5745 - Parameterize nightly compile over configurable branches - #5546 - Fix swapped preserve_order docstrings - #5817 - Update skrl agent configurations in the Isaac Lab template

# Description Merge changes from main branch: - isaac-sim#4875 - Adds Isaac-Stack-Cube-Franka-IK-Rel-v0 task variants - isaac-sim#4909 - Updates minor RSL-RL configclass docstring - isaac-sim#4934 - Updates Newton docs on main for 3.0 beta changes - isaac-sim#5182 - Fix flatdict version pin to allow 4.1.0+ - isaac-sim#5195 - Add NCCL troubleshooting notes - isaac-sim#5406 - Updates doc building job on main to match develop - isaac-sim#5311 - Update skrl integration for version 2.0.0 - isaac-sim#5482 - Adds nightly-changelog.yml on main - isaac-sim#5527 - Use isaaclab-bot GitHub App token for nightly changelog push - isaac-sim#5537 - Address deprecation warnings in nightly changelog workflow - isaac-sim#5746 - Fix .dockerignore for _isaac_sim symlink - isaac-sim#5745 - Parameterize nightly compile over configurable branches - isaac-sim#5546 - Fix swapped preserve_order docstrings - isaac-sim#5817 - Update skrl agent configurations in the Isaac Lab template

hujc7 requested review from hhansen-bdai and kellyguo11 as code owners May 7, 2026 05:45

github-actions Bot added the infrastructure label May 7, 2026

greptile-apps Bot reviewed May 7, 2026

View reviewed changes

Comment thread .github/workflows/nightly-changelog.yml

hujc7 changed the title ~~Use isaaclab-bot GitHub App token for nightly changelog push~~ [Changelog]Use isaaclab-bot GitHub App token for nightly changelog push May 7, 2026

kellyguo11 approved these changes May 8, 2026

View reviewed changes

hujc7 merged commit 3e73d6d into isaac-sim:main May 8, 2026
10 checks passed

hujc7 mentioned this pull request May 8, 2026

[CI] Address deprecation warnings in nightly changelog workflow #5537

Merged

2 tasks

kellyguo11 mentioned this pull request May 28, 2026

Merges changes from main #5824

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Changelog]Use isaaclab-bot GitHub App token for nightly changelog push#5527

[Changelog]Use isaaclab-bot GitHub App token for nightly changelog push#5527
hujc7 merged 2 commits into
isaac-sim:mainfrom
hujc7:jichuanh/changelog-app-token

hujc7 commented May 7, 2026

Uh oh!

greptile-apps Bot commented May 7, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

hujc7 commented May 7, 2026

Why

What this PR does

Side benefit: triggers downstream workflows

Setup status

Test plan

Uh oh!

greptile-apps Bot commented May 7, 2026

Greptile Summary

Confidence Score: 4/5

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants