MIP-0086 task 1: rename the Apps, widen marola-merge-bot, set the new secrets (a person)

What

§5.11 stage 0, done by an org owner in GitHub settings; no code. Rename marola-pointer-sync to marola-merge-bot first and confirm its App ID is still 5257042 (the umbrella's main-rule bypass is keyed on it; renaming keeping the ID is undocumented). Then rename marola-gemini-bot to marola-pr-bot, give the merge bot Workflows write and install it on every repo in marola-devkit's .github/consumers.txt, and create the new names beside the old ones, which stay until task 11.

⚠️ The renames change both bots' logins in every repo at once: list what matches the old logins and names first (gh search code --owner marola-dev plus git grep per repo).

Acceptance criteria

the list of everything matching marola-gemini-bot, marola-pointer-sync, GEMINI_APP_*, POINTER_SYNC_APP_* is commented here
marola-merge-bot's App ID before and after the rename is commented here
marola-pr-bot and marola-merge-bot exist; the merge bot holds Workflows write and is installed on every consumer
org variable PR_BOT_APP_ID and org secret PR_BOT_KEY (visibility all); MERGE_BOT_APP_ID and MERGE_BOT_KEY in marola and marola-devkit only; org variable AUTO_MERGE=true
no .pem kept anywhere after it was set

Named test

gh api orgs/marola-dev/installations --jq '.installations[] | {app_slug, app_id, repository_selection}' and gh secret list -R marola-dev/marola-site (no MERGE_BOT_KEY), outputs pasted here.

MIP-0086 (#773 until it merges) owns the design and its tasks file the order; this issue owns the status. Blockers are native blocked by edges from the tasks file's depends on column.

docs(mip-0086): link every task row to its issue

MIP-0086: docs(mip-0086): GitHub Apps for automation (#773)

Starting this today (2026-10-12), by hand: issue-claim refuses a person-only row, since it has no agent-ready and is already assigned. Step 1's list follows.

Step 1: what matches the old names (git grep -E 'marola-gemini-bot|marola-pointer-sync|GEMINI_APP_ID|GEMINI_APP_PRIVATE_KEY|POINTER_SYNC_APP' on a fresh --depth 1 clone of every non-archived marola-dev repo's main, 2026-10-12)

Workflows and config, the only hits that run:

marola/.github/workflows/pointer-sync-merge.yml:38-39: vars.POINTER_SYNC_APP_ID / secrets.POINTER_SYNC_APP_KEY (row 9 moves it)
marola-devkit/.github/workflows/gemini-review.yml:53,75-76: GEMINI_APP_PRIVATE_KEY declared, vars.GEMINI_APP_ID (row 2 / Task 7 moves it). The git identity comes from steps.app.outputs.app-slug at runtime, so it follows the rename.
marola-devkit/.github/rulesets/bypass-extras.json:7: the reason string only; the bypass is keyed on actor_id: 5257042

No workflow or script compares a marola-gemini-bot[bot] or marola-pointer-sync[bot] login, so neither rename stops anything from matching.

Docs only: README.md in marola, marola-app, marola-corpus, marola-ml, marola-oods and marola-site; marola/docs/3-Ways-of-working/CI-CD.md; MIP-0072 and its tasks file; docs/MIPs/README.md; marola-devkit's AGENTS.md, README.md, CHANGELOG.md and docs/4-reference_workflows.md. MIP-0086's own mentions are intentional. The docs move with each repo's row; nothing outside rows 2, 9 and 15 needs a new step.

App IDs before the rename (gh api orgs/marola-dev/installations):

marola-pointer-sync: app_id 5257042, installation 169772006, selected repos
marola-gemini-bot: app_id 5180623, installation 167671690, all repos

Steps 2–6 done (2026-10-12). Both renames kept their IDs: marola-pointer-sync → marola-merge-bot is still 5257042 (installation 169772006), and marola-gemini-bot → marola-pr-bot is still 5180623 (installation 167671690). main-rule still lists 5257042 (Integration, pull_request) as a bypass actor.

The merge bot now has workflows: write and is installed on the six repos in consumers.txt (marola, marola-app, marola-site, marola-ml, marola-corpus, marola-oods; the maintainer confirmed the list in the UI). Both new keys were set from .pem files that were deleted afterwards. The old keys and names (GEMINI_APP_*, POINTER_SYNC_APP_*) are untouched until row 11.

Named test

$ gh api orgs/marola-dev/installations --jq '.installations[] | {app_slug, app_id, repository_selection}'
{"app_id":1236702,"app_slug":"claude","repository_selection":"all"}
{"app_id":5180623,"app_slug":"marola-pr-bot","repository_selection":"all"}
{"app_id":5257042,"app_slug":"marola-merge-bot","repository_selection":"selected"}
$ gh secret list -R marola-dev/marola-site
CLOUDFLARE_ACCOUNT_ID	2026-10-07T15:22:54Z
CLOUDFLARE_API_TOKEN	2026-10-07T15:27:08Z

There is no MERGE_BOT_KEY in marola-site.

$ gh secret list --org marola-dev | grep PR_BOT;  gh variable list --org marola-dev | grep -E "PR_BOT|AUTO_MERGE"
PR_BOT_KEY	2026-10-12T19:10:39Z	ALL
AUTO_MERGE	true	2026-10-12T19:11:23Z	ALL
PR_BOT_APP_ID	5180623	2026-10-12T19:10:09Z	ALL
$ gh secret list -R marola-dev/marola | grep MERGE_BOT; gh variable list -R marola-dev/marola | grep MERGE_BOT
MERGE_BOT_KEY	2026-10-12T19:11:00Z
MERGE_BOT_APP_ID	5257042	2026-10-12T19:10:59Z
$ gh secret list -R marola-dev/marola-devkit | grep MERGE_BOT; gh variable list -R marola-dev/marola-devkit | grep MERGE_BOT
MERGE_BOT_KEY	2026-10-12T19:11:01Z
MERGE_BOT_APP_ID	5257042	2026-10-12T19:11:01Z

Not checked yet: that each new key actually mints a token. Row 2's bot-token-test is the first thing that uses PR_BOT_KEY.

Navigation Menu

Repository navigation

MIP-0086 task 1: rename the Apps, widen marola-merge-bot, set the new secrets (a person) #784

What

Acceptance criteria

Named test

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

MIP-0086 task 1: rename the Apps, widen marola-merge-bot, set the new secrets (a person) #784

Description

What

Acceptance criteria

Named test

Activity

brunogbv commented on Oct 12, 2026

brunogbv commented on Oct 12, 2026

brunogbv commented on Oct 12, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions