fix(ci): author the release PR with a third bot PAT - #9592
Conversation
GITHUB_TOKEN cannot create the release PR because the org disables GitHub Actions from creating or approving pull requests. The repo-level switch is rejected with 409 and the org-level switch requires org admin. Author the PR with CI_REVIEW_BOT_PAT (a third identity) instead, so ci-bot and dev-bot can both approve without self-approval blocking.
|
Thanks for the PR!
⏸️ Escalation: CODEOWNERS routes 中文说明感谢贡献!
⏸️ 升级说明:CODEOWNERS 将 — Qwen Code · qwen3.8-max Reviewed at |
Code Coverage Summary
CLI Package - Full Text ReportCore Package - Full Text ReportFor detailed HTML reports, please see the 'coverage-reports-22.x-ubuntu-latest' artifact from the main CI run. |
|
Released in v0.21.15. |
What this PR does
The release finalization workflow merges the release branch back into main by opening a pull request. This PR changes which account opens that pull request: instead of the built-in GitHub Actions token, a dedicated bot account now authors it, so the two bot accounts that approve it are no longer the author.
Why it's needed
Since #9056 the release pull request was opened with the built-in GitHub Actions token. That token can only open pull requests when the repository setting "Allow GitHub Actions to create and approve pull requests" is enabled, and the QwenLM organization disables that capability. As a result, finalization has failed to open the release pull request for the last three stable releases (v0.21.12, v0.21.13, v0.21.14), leaving main's package versions and CHANGELOG behind the released tags. A GitHub Actions token cannot be used here without an org-admin change, so the pull request is now authored with a third bot identity, which keeps the existing two-bot approval flow working.
Reviewer Test Plan
How to verify
Evidence (Before & After)
Before: finalization for v0.21.12/13/14 failed at the PR-creation step with
GitHub Actions is not permitted to create or approve pull requests (createPullRequest).After: not yet re-run — will be confirmed by re-running finalization for the missed tags.
Tested on
This is a CI workflow change; it is exercised by re-running the workflow, not by local OS testing.
Risk & Scope
Linked Issues
Related: #9056 (introduced the regression), #9054 (original self-approval problem).
中文说明
这个 PR 做了什么
发布收尾流程会打开一个 PR 把 release 分支合回 main。这个 PR 改变了打开该 PR 的账号:不再使用 GitHub Actions 内置 token,而是由一个专用 bot 账号来创建,这样负责审批的两个 bot 账号就不再是作者。
为什么需要它
自 #9056 起,release PR 用 GitHub Actions 内置 token 创建。该 token 只有在仓库开启 "Allow GitHub Actions to create and approve pull requests" 设置时才能创建 PR,而 QwenLM 组织禁用了这一能力。结果导致最近三个稳定版本(v0.21.12、v0.21.13、v0.21.14)的收尾流程都无法创建 release PR,main 上的 package 版本号和 CHANGELOG 落后于已发布的 tag。在不改动组织设置的前提下无法使用 GitHub Actions token,因此改用第三个 bot 身份来创建 PR,从而保持原有的双 bot 审批流程继续工作。
评审测试计划
如何验证
证据(前后对比)
之前:v0.21.12/13/14 的收尾流程在创建 PR 步骤失败,报错
GitHub Actions is not permitted to create or approve pull requests (createPullRequest)。之后:尚未重新运行——将通过对漏掉的 tag 重新运行收尾流程来确认。
测试环境
这是 CI workflow 改动,通过重新运行 workflow 来验证,而非本地操作系统测试。
风险与范围
关联 Issue
相关:#9056(引入该回归)、#9054(最初的 self-approval 问题)。