Skip to content

fix(release): route Scoop manifest update through a PR instead of a direct push #226

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
getappz merged 1 commit into from
Jul 17, 2026
Merged

fix(release): route Scoop manifest update through a PR instead of a direct push #226

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 25 additions & 7 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -195,14 +195,18 @@ jobs:
name: Update Scoop
needs: release
runs-on: ubuntu-latest
permissions:
contents: write
pull-requests: write
Comment on lines +198 to +200

@coderabbitai coderabbitai Bot Jul 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail
rg -n -C3 'CLA_SIGNATURES_TOKEN|Contents:' \
  .github/workflows/cla.yml .github/workflows/release.yml

Repository: getappz/agentflare

Length of output: 2168

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

sed -n '180,220p' .github/workflows/release.yml
printf '\n----\n'
sed -n '250,275p' .github/workflows/release.yml
printf '\n----\n'
sed -n '30,45p' .github/workflows/cla.yml

Repository: getappz/agentflare

Length of output: 3756

🌐 Web query:

GitHub fine-grained personal access token permissions create pull request pull requests write contents write gh pr create

💡 Result:

To use the GitHub CLI (gh) command gh pr create with a fine-grained personal access token (PAT), you must configure specific repository permissions [1]. For the most basic pull request creation, you require the following minimum permissions: 1. Pull Requests: Read and write [1] 2. Metadata: Read-only (This is automatically added as a mandatory requirement when you select 'Pull Requests: Read and write') [1] While the core functionality for creating a PR is covered by these, users often encounter errors (such as inability to access repository metadata or branch references) if their token lacks broader access [1]. If you encounter errors like "Resource not accessible by personal access token," it is recommended to also include: - Contents: Read-only (or Read and write, depending on your broader workflow needs) [1] Additional notes: - Using 'write' access automatically includes 'read' access for that permission [2]. - If you use features like --project (adding a PR to a project), you will need additional permissions such as Project (read) [3][4]. - The GitHub CLI does not always explicitly inform you which specific fine-grained permission is missing due to API limitations [1]. If a command fails unexpectedly, verify your token's configured permissions in your GitHub settings under Personal Access Tokens [2].

Citations:

Grant CLA_SIGNATURES_TOKEN pull-request access. gh pr create and gh pr merge use GH_TOKEN, so the job’s permissions block only affects GITHUB_TOKEN. The fine-grained PAT documented in .github/workflows/cla.yml needs Pull Requests: write in addition to Contents: write.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml around lines 198 - 200, Update the release
workflow permissions block to grant the token used by CLA_SIGNATURES_TOKEN
pull-request write access, while retaining contents write access. Ensure the
relevant pull-request permission is configured for the fine-grained PAT
documented in the CLA workflow.

steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
with:
ref: master
# Owner PAT (user-approved 2026-07-06): master's required-checks
# protection rejects pushes from the default GITHUB_TOKEN (GH006);
# enforce_admins is off, so a push authenticated as the admin owner
# goes through for this generated one-file manifest commit.
# Owner PAT: master requires an approved PR + passing required
# checks (enforce_admins is on, so no push — including an admin's
# — bypasses that). GITHUB_TOKEN-authored branch pushes/PRs don't
# trigger required CI checks, so this job needs a real user PAT to
# open a mergeable PR below rather than pushing directly.
token: ${{ secrets.CLA_SIGNATURES_TOKEN }}

- name: Download checksums and extract windows hash
Expand All @@ -219,7 +223,7 @@ jobs:
env:
GH_TOKEN: ${{ github.token }}

- name: Generate manifest and push to master
- name: Generate manifest and open PR
run: |
VERSION="${{ steps.checksums.outputs.version }}"
WINDOWS_SHA="${{ steps.checksums.outputs.windows_sha }}"
Expand All @@ -246,8 +250,22 @@ jobs:
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"
git add bucket/agentflare.json
git diff --cached --quiet || git commit -m "scoop manifest: agentflare ${VERSION}"
git push origin HEAD:master
if git diff --cached --quiet; then
echo "no manifest changes, skipping PR"
exit 0
fi

BRANCH="scoop-manifest-${VERSION}"
git checkout -b "$BRANCH"
git commit -m "scoop manifest: agentflare ${VERSION}"
git push origin "$BRANCH"

gh pr create --base master --head "$BRANCH" \
--title "scoop manifest: agentflare ${VERSION}" \
--body "Automated Scoop manifest update for release ${GITHUB_REF_NAME}."
gh pr merge "$BRANCH" --auto --squash --delete-branch
Comment on lines +258 to +266

@coderabbitai coderabbitai Bot Jul 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail
VERSION="${1:?usage: $0 <version>}"
BRANCH="scoop-manifest-${VERSION}"

git ls-remote --heads origin "refs/heads/${BRANCH}"
gh pr list --repo getappz/agentflare --base master --head "${BRANCH}" \
  --state open --json number,url,headRefOid

Repository: getappz/agentflare

Length of output: 195

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

# Locate the workflow and inspect the relevant section with line numbers.
git ls-files '.github/workflows/release.yml'
wc -l .github/workflows/release.yml
sed -n '230,290p' .github/workflows/release.yml

Repository: getappz/agentflare

Length of output: 2372

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

# Inspect the workflow around the manifest publishing steps.
sed -n '1,230p' .github/workflows/release.yml

Repository: getappz/agentflare

Length of output: 8557

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT

git init --bare "$tmp/remote.git" >/dev/null
git clone "$tmp/remote.git" "$tmp/a" >/dev/null
cd "$tmp/a"
git config user.name "bot"
git config user.email "bot@example.com"

mkdir -p bucket
echo '{"version":"1.2.3"}' > bucket/agentflare.json
git add bucket/agentflare.json
git commit -m "scoop manifest: agentflare 1.2.3" >/dev/null
git branch -M master
git push origin master:scoop-manifest-1.2.3 >/dev/null

git clone "$tmp/remote.git" "$tmp/b" >/dev/null
cd "$tmp/b"
git config user.name "bot"
git config user.email "bot@example.com"

git checkout -b master origin/master >/dev/null
mkdir -p bucket
echo '{"version":"1.2.3"}' > bucket/agentflare.json
git add bucket/agentflare.json
git commit -m "scoop manifest: agentflare 1.2.3" >/dev/null

set +e
git push origin HEAD:scoop-manifest-1.2.3
code=$?
set -e

echo "exit=$code"

Repository: getappz/agentflare

Length of output: 1122

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT

git init --bare "$tmp/remote.git" >/dev/null
git clone "$tmp/remote.git" "$tmp/repo" >/dev/null
cd "$tmp/repo"
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]`@users.noreply.github.com`"

# Base branch that mimics the workflow checkout.
echo base > README.md
git add README.md
git commit -m "base" >/dev/null
git branch -M master
git push origin master >/dev/null

make_commit() {
  rm -rf bucket
  mkdir -p bucket
  printf '%s\n' '{"version":"1.2.3","hash":"sha256:abc"}' > bucket/agentflare.json
  git add bucket/agentflare.json
  git commit -m "scoop manifest: agentflare 1.2.3" >/dev/null
  git rev-parse HEAD
}

git checkout -b scoop-manifest-1.2.3 master >/dev/null
sha1="$(make_commit)"
git push origin HEAD:scoop-manifest-1.2.3 >/dev/null

git checkout master >/dev/null
git branch -D scoop-manifest-1.2.3 >/dev/null
git checkout -b scoop-manifest-1.2.3 master >/dev/null
sha2="$(make_commit)"

set +e
git push origin HEAD:scoop-manifest-1.2.3
push_exit=$?
set -e

printf 'sha1=%s\nsha2=%s\npush_exit=%s\n' "$sha1" "$sha2" "$push_exit"

Repository: getappz/agentflare

Length of output: 1098

🌐 Web query:

gh pr create existing branch already has a pull request behavior open source documentation

💡 Result:

When using the GitHub CLI (gh), the gh pr create command is designed to prevent the creation of duplicate pull requests [1][2]. If an open pull request already exists for the same head branch and base branch, the command will fail and output an error message containing the URL of the existing pull request [1][3][4]. Because gh pr create does not automatically "upsert" (update) an existing pull request, users seeking to maintain or update an existing PR typically employ one of the following strategies in their scripts: 1. Manual Update: If a PR already exists, the intended changes are usually pushed via git push (or git push --force if necessary), which automatically updates the open pull request associated with that branch [3][5]. 2. Conditional Logic: Scripts often check for an existing PR before running the create command [3][5]. A common pattern is to attempt to list the PR for the current branch first; if one is found, the script can then use gh pr edit to update metadata (such as the title or body) instead of trying to create a new one [3][5]. The command does not currently provide a specific flag to automatically update an existing PR, nor does it return a unique exit code specifically for an "already exists" state, making it necessary to parse the error output or check for the PR existence programmatically if automated handling is required [3][5].

Citations:

Reuse the existing Scoop PR on reruns. The branch recreation already lands on the same commit, but gh pr create will fail once an open PR exists for scoop-manifest-${VERSION}. Look up that PR and reuse it, then enable merge on the existing head instead of creating a new one.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml around lines 258 - 266, Update the Scoop
release flow around the branch variable and gh pr create/merge commands to
detect an existing open PR for the scoop-manifest-${VERSION} branch, reuse its
PR number or reference, and skip creation when found. For a new branch PR,
retain the current creation behavior; in both cases, invoke gh pr merge on the
existing PR head with the current auto, squash, and delete-branch options.

Comment on lines +263 to +266

@coderabbitai coderabbitai Bot Jul 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail
gh api repos/getappz/agentflare/branches/master/protection/required_pull_request_reviews \
  --jq '{required_approving_review_count,require_code_owner_reviews,require_last_push_approval}'

Repository: getappz/agentflare

Length of output: 390

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

# Show the relevant workflow section with line numbers.
sed -n '190,280p' .github/workflows/release.yml | cat -n

# Look for repository-side branch protection / ruleset config.
git ls-files .github | sed -n '1,200p'
rg -n "required_approving_review_count|require_code_owner_reviews|require_last_push_approval|review|auto-merge|gh pr merge|master" .github -S

Repository: getappz/agentflare

Length of output: 5008

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

# Inspect the exact lines around the PR creation/merge logic.
nl -ba .github/workflows/release.yml | sed -n '200,270p'

# Search for any repo-local branch protection/ruleset config.
git ls-files | rg '(^|/)(branch-protection|ruleset|protection|settings)\.|\.github/.+(rules|protection)|CODEOWNERS$'
rg -n "required_approving_review_count|require_code_owner_reviews|require_last_push_approval|auto-merge|gh pr merge|gh pr create|master" -S .github . 2>/dev/null

Repository: getappz/agentflare

Length of output: 196

gh pr merge --auto still depends on a separate approval. .github/workflows/release.yml already notes that master requires an approved PR plus passing checks, so this PR will remain pending until a distinct reviewer approves it. If this is meant to be hands-off, provision a trusted approver; otherwise make manual approval an explicit release step.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml around lines 263 - 266, Update the release
workflow around the gh pr create and gh pr merge commands to make the approval
requirement explicit: either provision a trusted, distinct approver so
auto-merge can complete hands-off, or remove/defer automatic merging and add a
manual approval step before merging the generated Scoop manifest PR.

env:
GH_TOKEN: ${{ secrets.CLA_SIGNATURES_TOKEN }}

trigger-npm-publish:
name: Trigger npm publish
Expand Down