Repository navigation
Use built-in Actions tokens for gallery maintenance - #86
Closed
Jay Gordon (jaydestro) wants to merge 2 commits into
Closed
Jay Gordon (jaydestro) wants to merge 2 commits into
Jay Gordon (jaydestro) wants to merge 2 commits into
Conversation
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Fix review-command authorization, tighten publication permissions, and align documentation with the manual PR flow.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 1
Open (3)
What changed in this PR
Updates gallery maintenance to use built-in Actions tokens, publish proposal branches with compare links, and support human-created draft PRs.
Changes:
- Replaces PAT authentication with scoped
GITHUB_TOKENusage. - Updates workflows, tests, and authentication handling.
- Revises maintenance documentation and operational guidance.
| File | Summary |
|---|---|
scripts/gallery-audit/test/configuration.test.mjs |
Updates workflow configuration assertions. |
scripts/gallery-audit/index.mjs |
Supports built-in token authentication variables. |
docs/gallery-content-discovery-and-maintenance-proposal.md |
Documents the token and manual PR flow. |
docs/automated-gallery-maintenance.md |
Updates setup and maintenance guidance. |
.github/workflows/audit-gallery-content.yml |
Uses scoped permissions and publishes proposal branches. |
.github/workflows/apply-gallery-review.yml |
Applies review commands with the built-in token. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+22
to
+24
| permissions: | ||
| contents: write | ||
| pull-requests: write |
| ``` | ||
|
|
||
| `gh secret list` confirms only that the names exist. Validate the values by manually running **Audit gallery content**: classification must report `complete`, and an eligible proposal must be able to create or update the draft maintenance pull request. | ||
| Validate the configuration by manually running **Audit gallery content**: classification must report `complete`, and an eligible proposal must publish an automation branch and compare link. Open that link and create the draft pull request as a person. |
| 9. apply eligible changes to the per-run automation branch; | ||
| 10. run focused tests and the full Docusaurus build; | ||
| 11. open a new draft pull request with a separate write token; | ||
| 11. publish the proposal branch and a compare link for a person to open as a draft pull request; |
5 of 6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GITHUB_TOKENEnterprise policy
The enterprise blocks Actions from creating or approving pull requests. The audit therefore pushes a proposal branch but never creates, approves, or merges a PR. A person opens the emitted compare link and creates the draft PR.
Validation
npm run test:gallery-audit(71 passed)npm run buildThe smoke test successfully pushed a temporary branch using only job-scoped
contents: write; all temporary branches were deleted afterward.