devxy/build-cran-binaries
Watch
1
0
Fork
You've already forked build-cran-binaries
 0
Code Issues 10 Pull requests Releases Activity

chore(local): reuse FORGEJO_TOKEN for the auto-patch push (#125)

Browse source 
Follow-up to #124 (merged): the auto-patch pipeline required a separate write-scoped `REPO_RW_TOKEN` to push the branch. Reuse the existing `FORGEJO_TOKEN` instead.

- `propose-patches.R --open-pr` now pushes `auto/registry-patch-proposals` over HTTPS with `FORGEJO_TOKEN` (the same token used for the PR API); the read-only `origin` clone URL can't push, so it builds an authenticated URL explicitly.
- Drop `REPO_RW_TOKEN` from `.crow/auto-apply-patches.yaml` and the docs.

No new secret needed: the pipeline's secrets are now `PGPASS`, `REPO_RO_TOKEN`, and `FORGEJO_TOKEN` (all existing). `FORGEJO_TOKEN` must have repository write scope for the push to succeed.

105 tests pass; all pre-commit hooks pass.

Reviewed-on: #125
This commit is contained in:
Patrick Schratz 2026-07-15 14:50:19 +00:00 • committed by Patrick Schratz
commit 1bca6004fd
1 changed files with 17 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

5
local/patches/README.md
View file

@ -84,11 +84,12 @@ Rscript local/trial-build-patch.R <package>
#### Autonomous PR + trial-build gate
`--open-pr` closes the loop: it writes the top-N candidates (by failure volume) onto the reused `auto/registry-patch-proposals` branch and opens/updates a single PR.
`.crow/auto-apply-patches.yaml` runs this on a cron (needs `FORGEJO_TOKEN` and a write-scoped `REPO_RW_TOKEN`).
`.crow/auto-apply-patches.yaml` runs this on a cron.
`FORGEJO_TOKEN` is used for both the branch push and the PR (no separate write-scoped secret).
```bash
# Bounded batch; opens/updates one PR.
PGPASS=... FORGEJO_TOKEN=... REPO_RW_TOKEN=... Rscript local/propose-patches.R --open-pr --limit 10
PGPASS=... FORGEJO_TOKEN=... Rscript local/propose-patches.R --open-pr --limit 10
```
The merge gate is `.crow/trial-build-registry.yaml`: matrixed over the build-env images, each platform trial-builds only the entries the branch **adds** (`local/trial-build-registry.R`, which diffs the registry against `main`) and is green only if every new entry builds.