devxy/build-cran-binaries
Watch
1
0
Fork
You've already forked build-cran-binaries
 0
Code Issues 10 Pull requests Releases Activity

chore(local): reuse FORGEJO_TOKEN for the auto-patch push (#125)

Browse source 
Follow-up to #124 (merged): the auto-patch pipeline required a separate write-scoped `REPO_RW_TOKEN` to push the branch. Reuse the existing `FORGEJO_TOKEN` instead.

- `propose-patches.R --open-pr` now pushes `auto/registry-patch-proposals` over HTTPS with `FORGEJO_TOKEN` (the same token used for the PR API); the read-only `origin` clone URL can't push, so it builds an authenticated URL explicitly.
- Drop `REPO_RW_TOKEN` from `.crow/auto-apply-patches.yaml` and the docs.

No new secret needed: the pipeline's secrets are now `PGPASS`, `REPO_RO_TOKEN`, and `FORGEJO_TOKEN` (all existing). `FORGEJO_TOKEN` must have repository write scope for the push to succeed.

105 tests pass; all pre-commit hooks pass.

Reviewed-on: #125
This commit is contained in:
Patrick Schratz 2026-07-15 14:50:19 +00:00 • committed by Patrick Schratz
commit 1bca6004fd
2 changed files with 17 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

5
local/patches/README.md
View file

@ -84,11 +84,12 @@ Rscript local/trial-build-patch.R <package>
#### Autonomous PR + trial-build gate
`--open-pr` closes the loop: it writes the top-N candidates (by failure volume) onto the reused `auto/registry-patch-proposals` branch and opens/updates a single PR.
`.crow/auto-apply-patches.yaml` runs this on a cron (needs `FORGEJO_TOKEN` and a write-scoped `REPO_RW_TOKEN`).
`.crow/auto-apply-patches.yaml` runs this on a cron.
`FORGEJO_TOKEN` is used for both the branch push and the PR (no separate write-scoped secret).
```bash
# Bounded batch; opens/updates one PR.
PGPASS=... FORGEJO_TOKEN=... REPO_RW_TOKEN=... Rscript local/propose-patches.R --open-pr --limit 10
PGPASS=... FORGEJO_TOKEN=... Rscript local/propose-patches.R --open-pr --limit 10
```
The merge gate is `.crow/trial-build-registry.yaml`: matrixed over the build-env images, each platform trial-builds only the entries the branch **adds** (`local/trial-build-registry.R`, which diffs the registry against `main`) and is green only if every new entry builds.

25
local/propose-patches.R
View file

@ -21,8 +21,8 @@
# the proposals ledger (commit + open a PR yourself)
# --open-issue post/update a Forgejo tracking issue (needs FORGEJO_TOKEN)
# --open-pr write the entries, push the `auto/registry-patch-proposals`
# branch, and open/update a PR autonomously (needs
# FORGEJO_TOKEN, and REPO_RW_TOKEN to push in CI). The
# branch, and open/update a PR autonomously. Uses
# FORGEJO_TOKEN for both the push and the PR API. The
# `trial-build-registry` pipeline is the merge gate.
# --limit N only act on the top-N candidates by failure volume
# (bounded batch; the rest are picked up on the next run)
@ -466,18 +466,15 @@ if (do_write) {
if (length(candidate_entries) == 1L) "entry" else "entries"
)
)
# Push with a write token when provided (CI); otherwise rely on origin creds.
rw_token <- Sys.getenv("REPO_RW_TOKEN")
push_target <- if (nchar(rw_token) > 0L) {
sprintf(
"https://%s:%s@git.devxy.io/%s.git",
Sys.getenv("GIT_USER", "devxy-bot"),
rw_token,
repo
)
} else {
"origin"
}
# Push over HTTPS with FORGEJO_TOKEN (same token used for the PR API), so no
# separate write-scoped secret is needed. The read-only `origin` clone URL
# can't push, so build an authenticated URL explicitly.
push_target <- sprintf(
"https://%s:%s@git.devxy.io/%s.git",
Sys.getenv("GIT_REMOTE_USER", "pat-s"),
forgejo_token,
repo
)
git("push", "-f", push_target, sprintf("HEAD:refs/heads/%s", pr_branch))
pr_title <- sprintf(