Skip to content

Rebase pushes with the machine-user PAT (action-translation#125)#139

Merged
mmcky merged 1 commit into
mainfrom
rebase-token-pat
Jul 21, 2026
Merged

Rebase pushes with the machine-user PAT (action-translation#125)#139
mmcky merged 1 commit into
mainfrom
rebase-token-pat

Conversation

@mmcky

@mmcky mmcky commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

Completes the production half of action-translation#125: the rebase workflow now pushes with the machine-user PAT instead of the default GITHUB_TOKEN.

Why

Commits pushed with GITHUB_TOKEN do not trigger workflows — GitHub's recursion guard — so a rebased branch ends up with a run-less head: force-pushed re-translated content lands unreviewed, and with required status checks a run-less head blocks merging. Measured both ways on the test harness, same repo, same day: 13 GITHUB_TOKEN-rebased heads with zero workflow runs, versus a PAT-refreshed head whose review workflow triggered normally.

This is the same reasoning sync mode has always applied — its PRs trigger the review workflow because it passes the PAT. Rebase pushing to the same PRs with a weaker token was an inconsistency, not a decision.

Safety

  • No loop risk: rebase triggers on closed; the runs a PAT push triggers (CI, review) never push back.
  • Fork exposure: none, including on public repos — secrets are withheld from pull_request workflows triggered from forks regardless of repo visibility, and the job's if only matches branch prefixes the tooling creates.
  • The org-secret grant for this repo is in place (a missing grant fails loudly: Input required and not supplied: github-token).

The harness (test-translation-sync.zh-cn) has carried this exact configuration in steady state since validation.

🤖 Generated with Claude Code

Commits pushed with the default GITHUB_TOKEN trigger no workflows, so a
rebased branch gets a run-less head: force-pushed re-translated content
lands unreviewed, and with required checks a run-less head blocks
merging. Measured both ways on the test harness 2026-07-21 — zero runs
under GITHUB_TOKEN, review triggered under the PAT.

Sync mode has always passed the PAT for exactly this reason; rebase
pushing to the same PRs with a weaker token was an inconsistency, not a
decision.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings July 21, 2026 06:01
@netlify

netlify Bot commented Jul 21, 2026

Copy link
Copy Markdown

Deploy Preview for majestic-griffin-10b166 ready!

Name Link
🔨 Latest commit 5de5726
🔍 Latest deploy log https://app.netlify.com/projects/majestic-griffin-10b166/deploys/6a5f0b294e386f0007290862
😎 Deploy Preview https://deploy-preview-139--majestic-griffin-10b166.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the translation rebase GitHub Actions workflow so that rebases push using a machine-user PAT rather than the default GITHUB_TOKEN, ensuring the resulting force-pushed heads can trigger downstream workflows (and therefore required status checks).

Changes:

  • Switch github-token input from secrets.GITHUB_TOKEN to secrets.QUANTECON_SERVICES_PAT for the rebase step.
  • Clarify workflow documentation/comments around the CLI command name (translate forward --github) and the rationale for PAT usage.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@github-actions

Copy link
Copy Markdown

@github-actions
github-actions Bot temporarily deployed to pull request July 21, 2026 06:05 Inactive
@mmcky
mmcky merged commit 393aa83 into main Jul 21, 2026
8 checks passed
@mmcky
mmcky deleted the rebase-token-pat branch July 21, 2026 06:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants