also looking at this
fix(ci): bot commits land through a checked pull request, not a bypass
#274
10 files
+621
-23
| @@ -142,6 +142,10 @@ jobs: | ||
| 142 | 142 | # the commit — the gate cannot let a stale manifest through. |
| 143 | 143 | record: |
| 144 | 144 | needs: [publish-ubuntu, publish-macos] |
| 145 | permissions: | |
| 146 | contents: write | |
| 147 | actions: write | |
| 148 | pull-requests: write | |
| 145 | 149 | if: >- |
| 146 | 150 | always() && |
| 147 | 151 | needs.publish-ubuntu.result == 'success' && |
| @@ -160,17 +164,14 @@ jobs: | ||
| 160 | 164 | - name: Record verified registry state |
| 161 | 165 | working-directory: packages/ts-pantry |
| 162 | 166 | run: bun scripts/check-desktop-updates.ts --require-current --commit |
| 163 | - name: Push verified manifest commit | |
| 164 | working-directory: packages/ts-pantry | |
| 165 | run: | | |
| 166 | for attempt in 1 2 3 4 5; do | |
| 167 | if git push; then | |
| 168 | echo "push ok (attempt $attempt)" | |
| 169 | exit 0 | |
| 170 | fi | |
| 171 | echo "push rejected (attempt $attempt); rebasing onto latest main" | |
| 172 | git fetch origin main | |
| 173 | git rebase origin/main | |
| 174 | done | |
| 175 | echo "ERROR: could not push manifest after 5 attempts" >&2 | |
| 176 | exit 1 | |
| 167 | # The rebase-and-retry loop this replaces answered a race with another | |
| 168 | # push. It cannot answer the ruleset: main requires the CI contexts, a | |
| 169 | # bot push holds no repository role to be excused by, and retrying a | |
| 170 | # GH013 five times only rebases five times before failing anyway. | |
| 171 | - name: Land the verified manifest through a pull request | |
| 172 | uses: ./.github/actions/merge-via-pr | |
| 173 | with: | |
| 174 | token: ${{ secrets.PAT_TOKEN || secrets.GITHUB_TOKEN }} | |
| 175 | branch-prefix: chore/desktop-manifest | |
| 176 | body: | | |
| 177 | Verified desktop manifest state from `check-desktop-updates.yml`. | |