Repository navigation
ci: complete daily bot update PRs and automatic validation - #546
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Daily update scanning previously required a local CLI to create a PR, so the scheduled bot workflow was incomplete. Run the scan every day at 02:17 UTC and consume its exact plan inside a default-branch proposal job using GITHUB_TOKEN. The bot opens at most three new PRs per run and explicitly dispatches candidate, consumer, site and openkal checks on their branches. Existing PRs resume missing dispatches without duplicates.
Consumer/openkal dispatches verify an open same-repository bot PR, exact head SHA, default base and single descriptor before selecting affected members. Ordinary manual consumer runs remain full sweeps; PR/branch validation never creates more PRs. Only the proposal job has write permissions, and no persistent secret, automatic approval or merge is added. Organization/repository PR creation is now enabled by the maintainer; default workflow permissions remain read-only.
Document eligibility and append-only behavior in English/Chinese and the package skill. Ordinary package PRs must add eligible update declarations and leave root READMEs/site configuration alone. Simplify both root READMEs and link the detailed guides instead of appending package examples.
Validation: 8 local integration tests, Actionlint on all three changed workflows, declaration coverage for all 82 direct GitHub descriptors, and historical preservation for all 254 descriptors passed. Real bot PR creation/CI dispatch will be verified after this workflow reaches main.
Self-review: explicit read-only PR permissions are granted only where identity validation needs them. Dispatches validate the PR head and reject human/fork/closed/wrong-base/workflow-changing PRs. Duplicate detection also respects manual PRs already editing a package, such as httplib #542; their ordinary PR CI is retained. The updater is pinned to the squash-merged #2 commit 6c0bee2941e36132bc2ac3d1f7edbef8b5790320 (61 tests and all seven CI checks passed). Both root READMEs are 37 lines and their local links pass validation. Historical preservation still covers all 254 descriptors.