Align CI workflows with ProjectTemplate App-token pattern - #374
Merged
Conversation
Adopt the template's bot-PR / release pattern so main and develop are managed independently: - Replace WORKFLOW_PAT close/reopen workaround with GitHub App token (CODEGEN_APP_CLIENT_ID + CODEGEN_APP_PRIVATE_KEY) so codegen PRs fire downstream pull_request workflows natively. - Merge-bot becomes three jobs: enable auto-merge on opened/reopened (dependabot + codegen), disable auto-merge on maintainer push to a bot branch. Method dispatched per base ref: --squash on develop, --merge on main. Concurrency: cancel-in-progress false. - Codegen runs as a matrix over main and develop with head branches codegen-main and codegen-develop; close/reopen step removed. - Dependabot duplicates every ecosystem per branch and adds docker ecosystem coverage for Docker/*.Dockerfile. - Branch ruleset split (applied via gh): Develop branch (squash-only, linear history) and Main branch (merge-only), each with strict status-checks policy off. Old combined ruleset removed. WORKFLOW_PAT secret deleted. - test-pull-request triggers on both codegen-main and codegen-develop.
There was a problem hiding this comment.
Pull request overview
Aligns NxWitness CI automation with the ProjectTemplate “App-token” pattern so bot-authored PRs/merges can reliably trigger downstream workflows (avoiding GITHUB_TOKEN recursion guard) and so main/develop are managed independently with different merge methods.
Changes:
- Update merge-bot workflow to a 3-job model (enable auto-merge for Dependabot/codegen on open/reopen; disable auto-merge when a maintainer pushes to a bot PR) and dispatch merge method by target branch.
- Update codegen workflow to run as a
main/developmatrix producingcodegen-mainandcodegen-developPRs using a GitHub App installation token (removes close/reopen workaround). - Expand Dependabot config to open parallel PRs per ecosystem for both
mainanddevelop, including Docker updates for/Docker.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
| .github/workflows/test-pull-request.yml | Updates PR branch filter list to include the new codegen branch names. |
| .github/workflows/run-codegen-pull-request-task.yml | Runs codegen/formatting and opens PRs for both main and develop using an App installation token. |
| .github/workflows/merge-bot-pull-request.yml | Enables/disables auto-merge for bot PRs and selects merge method based on PR base branch using an App installation token. |
| .github/dependabot.yml | Duplicates update entries for main and develop and adds Docker ecosystem coverage for /Docker. |
- Bump actions/create-github-app-token from v1.12.0 to v3.2.0 (SHA pin) and switch from deprecated `app-id` input to `client-id`, matching the CODEGEN_APP_CLIENT_ID secret semantics. - Drop codegen-main/codegen-develop from test-pull-request.yml's branches filter: pull_request.branches filters on the PR base ref, not head, so the entries were inert (codegen PRs target main/develop which are already listed).
This was referenced May 24, 2026
Closed
ptr727
added a commit
that referenced
this pull request
May 24, 2026
## Summary Replaces #375 (which had textual conflicts in the two wholesale-replaced workflow files). This branch is a merge-commit of \`main\` into a sync branch off \`develop\`, with conflicts resolved by keeping develop's template-aligned versions of: - \`.github/workflows/merge-bot-pull-request.yml\` - \`.github/workflows/run-codegen-pull-request-task.yml\` All other files (CreateMatrix project bumps, version data, codegen output) merged cleanly. ## What's landing on main 10 commits total: 8 already on main (re-applied via the merge), plus develop's two: - **f8b06bd** Align CI workflows with ProjectTemplate App-token pattern (#374) — the big bot-PR / merge / dependency-update overhaul - **2fb7989** Address Copilot review comments on PR #366 - Plus the in-tree result of merging main's #366..#373 forward (codegen, dependabot bumps). ## Visible behavior changes for main - **Dependabot** now targets main for nuget, github-actions, AND docker (docker is new) with dual-target shape across main + develop. - **GitHub App token** (\`CODEGEN_APP_CLIENT_ID\` + \`CODEGEN_APP_PRIVATE_KEY\`) on \`actions/create-github-app-token@v3.2.0\` replaces the \`WORKFLOW_PAT\` close/reopen workaround. App-token pushes fire downstream \`pull_request\` events natively. - **Three-job merge-bot** with maintainer-push safeguard (auto-disables auto-merge on a bot PR when a maintainer commits to the branch). - **Method dispatch** by base ref: \`--squash\` on develop, \`--merge\` on main. Enforced upstream by the new per-branch rulesets. ## Last manual sync of its kind Going forward, the dual-target bots open parallel PRs against both branches, so main no longer accumulates content develop is missing. The branch-protection setup explicitly forbids main → develop back-merges (develop's squash-only + linear ruleset blocks merge commits on develop). ## Test plan - [ ] Once merged, post-merge push to main fires \`publish-release.yml\` automatically (validates App-token recursion-guard fix on main). - [ ] Next daily Dependabot cycle: parallel main + develop PRs per ecosystem group (nuget-deps, actions-deps, docker-deps). - [ ] Next weekly codegen run: parallel \`codegen-main\` → main and \`codegen-develop\` → develop PRs, each auto-merging with the correct method.
5 tasks
ptr727
added a commit
that referenced
this pull request
May 25, 2026
## Summary Closes part of #326 (investigation of Nx upstream Docker tweaks). Plan deliberately scoped to three changes: 1. **Adopt `currentOsVariantOverride=docker`** — append the line to `mediaserver.conf` at build time via `CreateMatrix/Dockerfile.cs`, regenerating 10 product Dockerfiles. Mirrors upstream's [`54bbd16`](networkoptix/nxvms-docker@54bbd16) (CI-3164). The two base images are untouched (they don't install mediaserver). 2. **Document upstream's `ignoreRootTool=true` deviation** — add a sub-bullet under Known Issues > Licensing noting that upstream's [`4285f93`](networkoptix/nxvms-docker@4285f93) (VMS-60430) disabled root-tool entirely, and explaining why NxWitness deliberately does not follow (license enforcement depends on root-tool). 3. **Refresh README compose examples** — add `tmpfs /tmp` (matches upstream's VMS-60430 switch) to all four compose snippets; bring the headline production example up to a real homelab pattern (`devices: /dev/dri` for iGPU passthrough, storage-pool comments, Traefik routing tweaks). ## Deliberately not adopted (rationale in plan) - **`ignoreRootTool=true` as a build-time default** — would break license enforcement for paying users; opposite of NxWitness's architecture. - **Plugin-extension Dockerfile pattern** (upstream's `extentions/nxai-plugin/Dockerfile`) — no point shipping example code we can't test end-to-end with a real plugin. - **`ENTRYPOINT_SCRIPTS_DIR` user init script hook** — same "untested surface area" reason; revisit if a concrete need arises. ## File-by-file - [`CreateMatrix/Dockerfile.cs`](CreateMatrix/Dockerfile.cs) — one new RUN step inserted in `CreateInstall()` after the mediaserver deb install, before the LSIO/non-LSIO branching. Applies to both variants. - `Docker/*.Dockerfile` (10 files) — regenerated via `Make/Create.sh`; mechanical 5-line addition per product image, no other diff. - [`README.md`](README.md) — one new bullet under Licensing; `tmpfs` added to 4 compose blocks; production example expanded with `devices`, comments, routing label. ## Test plan - [x] `dotnet build CreateMatrix/CreateMatrix.csproj` — clean (0 warnings, 0 errors). - [x] `dotnet test CreateMatrixTests/CreateMatrixTests.csproj` — 16/16 pass. - [x] `grep -c currentOsVariantOverride=docker Docker/*.Dockerfile` — 10/10 product images, 0/2 base images. - [ ] (post-merge) Build any product image and `docker run --rm --entrypoint=cat <img> /opt/<company>/mediaserver/etc/mediaserver.conf | grep currentOsVariantOverride` shows the line. - [ ] CI matrix on this branch passes (same workflow that validated PR #374).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Brings the bot-PR / merge / dependency workflows in line with ptr727/ProjectTemplate. Two visible behavior changes for derived repos:
--squashon develop (kept linear),--mergeon main (preserves develop's commit list as a real second parent). Dispatched by acaseonpull_request.base.refin the merge-bot.pull_requestworkflow events natively; theWORKFLOW_PATsecret and thegh pr close && gh pr reopendance are gone.File changes
.github/dependabot.yml— 6 entries: nuget × {main, develop}, github-actions × {main, develop}, docker × {main, develop} (new — covers all 13Docker/*.Dockerfiles)..github/workflows/merge-bot-pull-request.yml— copied wholesale from template. Three jobs (merge-dependabot,merge-codegen,disable-auto-merge-on-maintainer-push),cancel-in-progress: false(load-bearing for the three-job model), App-token viaactions/create-github-app-tokenSHA-pinned to v1.12.0, head/base pairing enforced on codegen, bot loginptr727-codegen[bot]..github/workflows/run-codegen-pull-request-task.yml— matrix over main + develop with branchescodegen-main/codegen-develop, App-token, no close/reopen, NxWitness-specific bits preserved (CreateMatrix.csprojcodegen command,dotnet husky install, noNINJA_API_KEY)..github/workflows/test-pull-request.yml— branches list updated to[ main, develop, codegen-main, codegen-develop ].Already applied out-of-band
CODEGEN_APP_CLIENT_ID+CODEGEN_APP_PRIVATE_KEYexist in Actions and Dependabot contexts;WORKFLOW_PATdeleted.Note on secret naming
Workflows reference
CODEGEN_APP_CLIENT_ID(Client ID), not the template'sCODEGEN_APP_ID(numeric App ID). Both work withactions/create-github-app-token, but the template'sapp-idinput is deprecated in newer versions of the action in favor ofclient-id. NxWitness adopts the modern naming directly. Template issue filed to bring the upstream in line.Test plan
gh workflow run run-periodic-codegen-pull-request.yml; expect two PRs (codegen-main → main, codegen-develop → develop), both authored byptr727-codegen[bot], no close/reopen timeline events.gh pr view <N> --json autoMergeRequestshowsmergeMethod: MERGEon main-targeted PR andmergeMethod: SQUASHon develop-targeted PR.publish-release.ymlautomatically (validates the recursion-guard fix).disable-auto-merge-on-maintainer-pushruns andautoMergeRequestbecomes null.nuget-deps,actions-deps,docker-deps). Semver-major NuGet stays open without auto-merge.