From 01ea924290fcbb84eb1be8f57fa2678a8d16a895 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bruno=20Guilhermo=20de=20Barros=20Val=C3=A9rio?= Date: Sat, 17 Oct 2026 09:42:56 +0200 Subject: [PATCH] skills-update drops its token secret fallback (pre-MIP-0086) The workflow pushes and opens its PR with marola-pr-bot's token when the caller passes pr_bot_key, else with GITHUB_TOKEN. The optional token secret (an old PAT path) is no longer declared, as #132 did for notify-umbrella and gemini-review. No caller passes it today: marola-site and this repo pass pr_bot_key, the umbrella passes nothing. Closes #148 Tested: devkit-quality.sh (just quality's steps without Nix: actionlint, self-tests, docs_lint, release --check, merge_key_check, wiring --lint-devkit) rc=0; no skills-update caller in the umbrella, its submodules or this repo passes token: Co-Authored-By: Claude --- .github/workflows/skills-update.yml | 9 +++------ CHANGELOG.md | 6 ++++++ docs/4-reference_workflows.md | 4 ++-- 3 files changed, 11 insertions(+), 8 deletions(-) diff --git a/.github/workflows/skills-update.yml b/.github/workflows/skills-update.yml index 0025e4e..4eeb143 100644 --- a/.github/workflows/skills-update.yml +++ b/.github/workflows/skills-update.yml @@ -1,7 +1,7 @@ # skills-update: re-vendor every skill in the caller's skills.lock at its upstream's newest commit # at least `min-age` days old, and keep one PR open on `branch` with the diffs as its body # (MIP-0080; docs/4-reference_workflows.md#skills-update). Nothing merges on its own. -# A PR opened with the default GITHUB_TOKEN starts no CI; pass `pr_bot_key` (marola-pr-bot) or a PAT as `token`. +# A PR opened with the default GITHUB_TOKEN starts no CI; pass `pr_bot_key` (marola-pr-bot). name: skills-update on: @@ -28,9 +28,6 @@ on: pr_bot_key: description: "marola-pr-bot's private key; mints the token that pushes and opens the PR, so the PR starts CI" required: false - token: - description: "pushes the branch and opens the PR when pr_bot_key is absent; the default GITHUB_TOKEN otherwise" - required: false permissions: contents: write @@ -72,7 +69,7 @@ jobs: - uses: actions/checkout@v7 with: - token: ${{ steps.app.outputs.token || secrets.token || github.token }} + token: ${{ steps.app.outputs.token || github.token }} - uses: actions/checkout@v7 with: @@ -82,7 +79,7 @@ jobs: - name: skills-vendor update --all, then push the branch and open or refresh the PR env: - GH_TOKEN: ${{ steps.app.outputs.token || secrets.token || github.token }} + GH_TOKEN: ${{ steps.app.outputs.token || github.token }} BRANCH: ${{ inputs.branch }} LOCK: ${{ inputs.lock }} MIN_AGE: ${{ inputs.min-age }} diff --git a/CHANGELOG.md b/CHANGELOG.md index 0ddcd4e..8a8b7c3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,12 @@ Each release moves `plugin.json`'s `version`, the flake package version and ever together. A consumer adopts one by bumping its flake input, its workflow `@v…`/`devkit-ref` and its marketplace `ref` at once. +## Unreleased + +- **Breaking** for a caller that passes `token:` to `skills-update`: the secret is no longer declared, + so the caller's workflow fails at the bump. `skills-update` drops the `token` (old PAT) fallback and + uses `pr_bot_key`, else the default `GITHUB_TOKEN` (MIP-0086, #148). + ## v0.16.0 — 2026-10-17 - `wiring.py` reports a `/dispatches` call whose type it cannot read, and `--check` fails on it; `wiring.py --lint-devkit` fails on that, or on a `repository_dispatch` type no devkit workflow sends, in the devkit's own workflows, and devkit CI runs it on every PR (#163). diff --git a/docs/4-reference_workflows.md b/docs/4-reference_workflows.md index 81dfb5d..b787001 100644 --- a/docs/4-reference_workflows.md +++ b/docs/4-reference_workflows.md @@ -441,8 +441,8 @@ jobs: Secret `pr_bot_key`, optional: `marola-pr-bot`'s private key (`vars.PR_BOT_APP_ID` is its id). The workflow mints a token for the caller's repo and pushes and opens the PR with it, so the PR starts -CI; a PR opened with the default `GITHUB_TOKEN` starts none. Secret `token`, optional: a PAT used -when `pr_bot_key` is absent. With neither, the job behaves as before. +CI. Without it, the job pushes and opens the PR with the default `GITHUB_TOKEN`, and that PR starts +no CI. A caller that still passes `token` fails, because the secret is no longer declared (MIP-0086). ## bot-token (composite action)