Repository navigation
ci(pstack): let the upstream sync open its pull request as you, so its checks start without approval - #23
Merged
Conversation
…s checks start without approval GitHub holds the runs of a pull request the Actions bot pushes, so every sync pull request waited for someone to click Approve workflows to run. With an optional PSTACK_SYNC_TOKEN secret, the sync pushes and opens the pull request with that token, and its checks start on their own. Without the secret, it falls back to the Actions token and behaves as before. The first behavior test of sync-upstream.sh runs the real script against throwaway repos and a fake gh, in both modes.
mstephenholl
added a commit
that referenced
this pull request
Oct 20, 2026
…e scarce (#25) ## Why GitHub's macOS arm64 runners are short on capacity. The `Install (macos-latest, bash)` job was cancelled five times in a row today, with the annotation "The job was not acquired by Runner of type hosted even after multiple attempts". That failed `CI gate` on `main`, so #23 never released, and it blocks #22. ## What changes The install matrix drops the macOS `bash` entry. Ubuntu still tests a current bash. The macOS `/bin/bash` job still tests bash 3.2 and macOS's `stat` and `date`, and it got a runner on every attempt today. Each run now needs one macOS runner instead of two. ## Risk A bug that shows up only with a current bash on macOS's userland would go uncaught. Neither of the other two jobs would catch it. ## Proof `test_github_settings.py` and `check.py` pass. Merging this releases #23's change too, since the release covers everything since v0.2.14.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
GitHub holds the checks of a pull request the Actions bot pushes. So every upstream sync pull request (#7, #14, #19, #21, #22) waited for someone to click Approve workflows to run before it could merge.
What changes
ghwith thePSTACK_SYNC_TOKENsecret when it is set, and with the Actions token when it is not.sync-upstream.shdispatches the early CI run, and writes the approval paragraph into the pull request body, only when the Actions bot is acting (AS_ACTIONS_BOT=true). A maintainer running the script locally also gets the quieter behavior now, sinceghacts as them.port/README.mdsays how to create the token: a fine-grained token scoped to this repository, with read and write Contents, Pull requests, and Issues.Nothing changes until the secret is set.
Risk
An expired or revoked token fails the sync until it is renewed or the secret is deleted. The token has no Workflows or Administration permission.
Proof
test_sync_upstream.pyruns the realsync-upstream.shandmerge-upstream.pyagainst throwaway repos and a fakegh. The bot-mode test passed before the change. The person-mode test failed before it and passes after. The full suite passes (243 tests), andcheck.pyreports 0 problems.