fix(release): route Scoop manifest update through a PR instead of a direct push - #226
Conversation
…irect push to master master's enforce_admins is now on, so the admin PAT push (GH006) fails — this job route via branch + PR + auto-merge instead, which works regardless of enforce_admins.
📝 WalkthroughWalkthroughThe release workflow now updates the Scoop manifest by creating and automatically merging a pull request from a versioned branch, with expanded pull request permissions and an early exit when no manifest changes are detected. ChangesScoop manifest update
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant update_scoop as update-scoop job
participant manifest as bucket/agentflare.json
participant github as GitHub repository
update_scoop->>manifest: Check for manifest changes
update_scoop->>github: Push scoop-manifest-${VERSION} branch
update_scoop->>github: Create pull request targeting master
update_scoop->>github: Auto-squash merge and delete branch
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 198-200: Update the release workflow permissions block to grant
the token used by CLA_SIGNATURES_TOKEN pull-request write access, while
retaining contents write access. Ensure the relevant pull-request permission is
configured for the fine-grained PAT documented in the CLA workflow.
- Around line 263-266: Update the release workflow around the gh pr create and
gh pr merge commands to make the approval requirement explicit: either provision
a trusted, distinct approver so auto-merge can complete hands-off, or
remove/defer automatic merging and add a manual approval step before merging the
generated Scoop manifest PR.
- Around line 258-266: Update the Scoop release flow around the branch variable
and gh pr create/merge commands to detect an existing open PR for the
scoop-manifest-${VERSION} branch, reuse its PR number or reference, and skip
creation when found. For a new branch PR, retain the current creation behavior;
in both cases, invoke gh pr merge on the existing PR head with the current auto,
squash, and delete-branch options.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: ff7f9da1-8e80-479e-9b88-3e9b1facd2ca
📒 Files selected for processing (1)
.github/workflows/release.yml
| permissions: | ||
| contents: write | ||
| pull-requests: write |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
rg -n -C3 'CLA_SIGNATURES_TOKEN|Contents:' \
.github/workflows/cla.yml .github/workflows/release.ymlRepository: getappz/agentflare
Length of output: 2168
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
sed -n '180,220p' .github/workflows/release.yml
printf '\n----\n'
sed -n '250,275p' .github/workflows/release.yml
printf '\n----\n'
sed -n '30,45p' .github/workflows/cla.ymlRepository: getappz/agentflare
Length of output: 3756
🌐 Web query:
GitHub fine-grained personal access token permissions create pull request pull requests write contents write gh pr create
💡 Result:
To use the GitHub CLI (gh) command gh pr create with a fine-grained personal access token (PAT), you must configure specific repository permissions [1]. For the most basic pull request creation, you require the following minimum permissions: 1. Pull Requests: Read and write [1] 2. Metadata: Read-only (This is automatically added as a mandatory requirement when you select 'Pull Requests: Read and write') [1] While the core functionality for creating a PR is covered by these, users often encounter errors (such as inability to access repository metadata or branch references) if their token lacks broader access [1]. If you encounter errors like "Resource not accessible by personal access token," it is recommended to also include: - Contents: Read-only (or Read and write, depending on your broader workflow needs) [1] Additional notes: - Using 'write' access automatically includes 'read' access for that permission [2]. - If you use features like --project (adding a PR to a project), you will need additional permissions such as Project (read) [3][4]. - The GitHub CLI does not always explicitly inform you which specific fine-grained permission is missing due to API limitations [1]. If a command fails unexpectedly, verify your token's configured permissions in your GitHub settings under Personal Access Tokens [2].
Citations:
- 1: Detect missing fine grain permission scopes, notify user on steps to take to refresh scopes cli/cli#9403
- 2: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens
- 3: https://cli.github.com/manual/gh%5Fpr%5Fcreate
- 4: Cannot use fine-grained PATs to add labels to pull requests cli/cli#9166
Grant CLA_SIGNATURES_TOKEN pull-request access. gh pr create and gh pr merge use GH_TOKEN, so the job’s permissions block only affects GITHUB_TOKEN. The fine-grained PAT documented in .github/workflows/cla.yml needs Pull Requests: write in addition to Contents: write.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 198 - 200, Update the release
workflow permissions block to grant the token used by CLA_SIGNATURES_TOKEN
pull-request write access, while retaining contents write access. Ensure the
relevant pull-request permission is configured for the fine-grained PAT
documented in the CLA workflow.
| BRANCH="scoop-manifest-${VERSION}" | ||
| git checkout -b "$BRANCH" | ||
| git commit -m "scoop manifest: agentflare ${VERSION}" | ||
| git push origin "$BRANCH" | ||
|
|
||
| gh pr create --base master --head "$BRANCH" \ | ||
| --title "scoop manifest: agentflare ${VERSION}" \ | ||
| --body "Automated Scoop manifest update for release ${GITHUB_REF_NAME}." | ||
| gh pr merge "$BRANCH" --auto --squash --delete-branch |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
VERSION="${1:?usage: $0 <version>}"
BRANCH="scoop-manifest-${VERSION}"
git ls-remote --heads origin "refs/heads/${BRANCH}"
gh pr list --repo getappz/agentflare --base master --head "${BRANCH}" \
--state open --json number,url,headRefOidRepository: getappz/agentflare
Length of output: 195
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
# Locate the workflow and inspect the relevant section with line numbers.
git ls-files '.github/workflows/release.yml'
wc -l .github/workflows/release.yml
sed -n '230,290p' .github/workflows/release.ymlRepository: getappz/agentflare
Length of output: 2372
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
# Inspect the workflow around the manifest publishing steps.
sed -n '1,230p' .github/workflows/release.ymlRepository: getappz/agentflare
Length of output: 8557
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT
git init --bare "$tmp/remote.git" >/dev/null
git clone "$tmp/remote.git" "$tmp/a" >/dev/null
cd "$tmp/a"
git config user.name "bot"
git config user.email "bot@example.com"
mkdir -p bucket
echo '{"version":"1.2.3"}' > bucket/agentflare.json
git add bucket/agentflare.json
git commit -m "scoop manifest: agentflare 1.2.3" >/dev/null
git branch -M master
git push origin master:scoop-manifest-1.2.3 >/dev/null
git clone "$tmp/remote.git" "$tmp/b" >/dev/null
cd "$tmp/b"
git config user.name "bot"
git config user.email "bot@example.com"
git checkout -b master origin/master >/dev/null
mkdir -p bucket
echo '{"version":"1.2.3"}' > bucket/agentflare.json
git add bucket/agentflare.json
git commit -m "scoop manifest: agentflare 1.2.3" >/dev/null
set +e
git push origin HEAD:scoop-manifest-1.2.3
code=$?
set -e
echo "exit=$code"Repository: getappz/agentflare
Length of output: 1122
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT
git init --bare "$tmp/remote.git" >/dev/null
git clone "$tmp/remote.git" "$tmp/repo" >/dev/null
cd "$tmp/repo"
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]`@users.noreply.github.com`"
# Base branch that mimics the workflow checkout.
echo base > README.md
git add README.md
git commit -m "base" >/dev/null
git branch -M master
git push origin master >/dev/null
make_commit() {
rm -rf bucket
mkdir -p bucket
printf '%s\n' '{"version":"1.2.3","hash":"sha256:abc"}' > bucket/agentflare.json
git add bucket/agentflare.json
git commit -m "scoop manifest: agentflare 1.2.3" >/dev/null
git rev-parse HEAD
}
git checkout -b scoop-manifest-1.2.3 master >/dev/null
sha1="$(make_commit)"
git push origin HEAD:scoop-manifest-1.2.3 >/dev/null
git checkout master >/dev/null
git branch -D scoop-manifest-1.2.3 >/dev/null
git checkout -b scoop-manifest-1.2.3 master >/dev/null
sha2="$(make_commit)"
set +e
git push origin HEAD:scoop-manifest-1.2.3
push_exit=$?
set -e
printf 'sha1=%s\nsha2=%s\npush_exit=%s\n' "$sha1" "$sha2" "$push_exit"Repository: getappz/agentflare
Length of output: 1098
🌐 Web query:
gh pr create existing branch already has a pull request behavior open source documentation
💡 Result:
When using the GitHub CLI (gh), the gh pr create command is designed to prevent the creation of duplicate pull requests [1][2]. If an open pull request already exists for the same head branch and base branch, the command will fail and output an error message containing the URL of the existing pull request [1][3][4]. Because gh pr create does not automatically "upsert" (update) an existing pull request, users seeking to maintain or update an existing PR typically employ one of the following strategies in their scripts: 1. Manual Update: If a PR already exists, the intended changes are usually pushed via git push (or git push --force if necessary), which automatically updates the open pull request associated with that branch [3][5]. 2. Conditional Logic: Scripts often check for an existing PR before running the create command [3][5]. A common pattern is to attempt to list the PR for the current branch first; if one is found, the script can then use gh pr edit to update metadata (such as the title or body) instead of trying to create a new one [3][5]. The command does not currently provide a specific flag to automatically update an existing PR, nor does it return a unique exit code specifically for an "already exists" state, making it necessary to parse the error output or check for the PR existence programmatically if automated handling is required [3][5].
Citations:
- 1: https://github.com/cli/cli/blob/trunk/pkg/cmd/pr/create/create.go
- 2:
pr createshoud fail faster if a PR already exists cli/cli#649 - 3: gh pr create should detect and update already existing pull requests cli/cli#5792
- 4: gh pr create duplicate even if different bases cli/cli#718
- 5: Different exit code for
gh pr createif pull request already exists cli/cli#13571
Reuse the existing Scoop PR on reruns. The branch recreation already lands on the same commit, but gh pr create will fail once an open PR exists for scoop-manifest-${VERSION}. Look up that PR and reuse it, then enable merge on the existing head instead of creating a new one.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 258 - 266, Update the Scoop
release flow around the branch variable and gh pr create/merge commands to
detect an existing open PR for the scoop-manifest-${VERSION} branch, reuse its
PR number or reference, and skip creation when found. For a new branch PR,
retain the current creation behavior; in both cases, invoke gh pr merge on the
existing PR head with the current auto, squash, and delete-branch options.
| gh pr create --base master --head "$BRANCH" \ | ||
| --title "scoop manifest: agentflare ${VERSION}" \ | ||
| --body "Automated Scoop manifest update for release ${GITHUB_REF_NAME}." | ||
| gh pr merge "$BRANCH" --auto --squash --delete-branch |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
gh api repos/getappz/agentflare/branches/master/protection/required_pull_request_reviews \
--jq '{required_approving_review_count,require_code_owner_reviews,require_last_push_approval}'Repository: getappz/agentflare
Length of output: 390
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
# Show the relevant workflow section with line numbers.
sed -n '190,280p' .github/workflows/release.yml | cat -n
# Look for repository-side branch protection / ruleset config.
git ls-files .github | sed -n '1,200p'
rg -n "required_approving_review_count|require_code_owner_reviews|require_last_push_approval|review|auto-merge|gh pr merge|master" .github -SRepository: getappz/agentflare
Length of output: 5008
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
# Inspect the exact lines around the PR creation/merge logic.
nl -ba .github/workflows/release.yml | sed -n '200,270p'
# Search for any repo-local branch protection/ruleset config.
git ls-files | rg '(^|/)(branch-protection|ruleset|protection|settings)\.|\.github/.+(rules|protection)|CODEOWNERS$'
rg -n "required_approving_review_count|require_code_owner_reviews|require_last_push_approval|auto-merge|gh pr merge|gh pr create|master" -S .github . 2>/dev/nullRepository: getappz/agentflare
Length of output: 196
gh pr merge --auto still depends on a separate approval. .github/workflows/release.yml already notes that master requires an approved PR plus passing checks, so this PR will remain pending until a distinct reviewer approves it. If this is meant to be hands-off, provision a trusted approver; otherwise make manual approval an explicit release step.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 263 - 266, Update the release
workflow around the gh pr create and gh pr merge commands to make the approval
requirement explicit: either provision a trusted, distinct approver so
auto-merge can complete hands-off, or remove/defer automatic merging and add a
manual approval step before merging the generated Scoop manifest PR.
1 participant
The `Update Scoop` job in release.yml pushed the manifest straight to `master` using an admin PAT, relying on `enforce_admins` being off. It's now on (`gh api repos/getappz/agentflare/branches/master/protection` confirms it), so both the v1.3.1 and v1.4.0 releases hit `GH006: Protected branch update failed`.
Fix: the job now creates a branch, opens a PR, and auto-merges it (0 required approvals, so it merges as soon as required checks pass) — same end result, but goes through the normal PR flow instead of trying to bypass branch protection. Still uses the owner PAT (`CLA_SIGNATURES_TOKEN`) since `GITHUB_TOKEN`-authored branch pushes don't trigger the required CI checks.
Summary by CodeRabbit