devxy/build-cran-binaries
Watch
1
0
Fork
You've already forked build-cran-binaries
 0
Code Issues 10 Pull requests Releases Activity

chore(local): reuse FORGEJO_TOKEN for the auto-patch push instead of a new secret

Browse source 
Push the auto/registry-patch-proposals branch over HTTPS with FORGEJO_TOKEN (the
same token already used for the PR API), so no separate write-scoped REPO_RW_TOKEN
secret is needed. Drop it from propose-patches.R, the pipeline, and the docs.
This commit is contained in:
Patrick Schratz 2026-07-15 14:37:27 +00:00
commit aac87045e8
No known key found for this signature in database
GPG key ID: 62050D5BC68AB6DC
3 changed files with 17 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

7
.crow/auto-apply-patches.yaml
View file

@ -6,8 +6,9 @@
# human reviews the PR. Novel source diffs / unknown signatures are never # human reviews the PR. Novel source diffs / unknown signatures are never
# proposed. Global across platforms, so a single job -- no matrix. # proposed. Global across platforms, so a single job -- no matrix.
# #
# Needs a write token (REPO_RW_TOKEN) to push and FORGEJO_TOKEN to open the PR. # FORGEJO_TOKEN is used for both the branch push and opening the PR (no separate
# Register the `auto-apply-patches` cron in the crow UI, or run manually: # write-scoped secret needed). Register the `auto-apply-patches` cron in the crow
# UI, or run manually:
# woodpecker-cli pipeline create --var task=auto-apply-patches --branch=main 7 # woodpecker-cli pipeline create --var task=auto-apply-patches --branch=main 7
variables: variables:
patch_limit: patch_limit:
@ -34,8 +35,6 @@ steps:
from_secret: PGPASS from_secret: PGPASS
REPO_RO_TOKEN: REPO_RO_TOKEN:
from_secret: REPO_RO_TOKEN from_secret: REPO_RO_TOKEN
REPO_RW_TOKEN:
from_secret: REPO_RW_TOKEN
FORGEJO_TOKEN: FORGEJO_TOKEN:
from_secret: FORGEJO_TOKEN from_secret: FORGEJO_TOKEN
GIT_USER: devxy-bot GIT_USER: devxy-bot

5
local/patches/README.md
View file

@ -84,11 +84,12 @@ Rscript local/trial-build-patch.R <package>
#### Autonomous PR + trial-build gate #### Autonomous PR + trial-build gate
`--open-pr` closes the loop: it writes the top-N candidates (by failure volume) onto the reused `auto/registry-patch-proposals` branch and opens/updates a single PR. `--open-pr` closes the loop: it writes the top-N candidates (by failure volume) onto the reused `auto/registry-patch-proposals` branch and opens/updates a single PR.
`.crow/auto-apply-patches.yaml` runs this on a cron (needs `FORGEJO_TOKEN` and a write-scoped `REPO_RW_TOKEN`). `.crow/auto-apply-patches.yaml` runs this on a cron.
`FORGEJO_TOKEN` is used for both the branch push and the PR (no separate write-scoped secret).
```bash ```bash
# Bounded batch; opens/updates one PR. # Bounded batch; opens/updates one PR.
PGPASS=... FORGEJO_TOKEN=... REPO_RW_TOKEN=... Rscript local/propose-patches.R --open-pr --limit 10 PGPASS=... FORGEJO_TOKEN=... Rscript local/propose-patches.R --open-pr --limit 10
``` ```
The merge gate is `.crow/trial-build-registry.yaml`: matrixed over the build-env images, each platform trial-builds only the entries the branch **adds** (`local/trial-build-registry.R`, which diffs the registry against `main`) and is green only if every new entry builds. The merge gate is `.crow/trial-build-registry.yaml`: matrixed over the build-env images, each platform trial-builds only the entries the branch **adds** (`local/trial-build-registry.R`, which diffs the registry against `main`) and is green only if every new entry builds.

25
local/propose-patches.R
View file

@ -21,8 +21,8 @@
# the proposals ledger (commit + open a PR yourself) # the proposals ledger (commit + open a PR yourself)
# --open-issue post/update a Forgejo tracking issue (needs FORGEJO_TOKEN) # --open-issue post/update a Forgejo tracking issue (needs FORGEJO_TOKEN)
# --open-pr write the entries, push the `auto/registry-patch-proposals` # --open-pr write the entries, push the `auto/registry-patch-proposals`
# branch, and open/update a PR autonomously (needs # branch, and open/update a PR autonomously. Uses
# FORGEJO_TOKEN, and REPO_RW_TOKEN to push in CI). The # FORGEJO_TOKEN for both the push and the PR API. The
# `trial-build-registry` pipeline is the merge gate. # `trial-build-registry` pipeline is the merge gate.
# --limit N only act on the top-N candidates by failure volume # --limit N only act on the top-N candidates by failure volume
# (bounded batch; the rest are picked up on the next run) # (bounded batch; the rest are picked up on the next run)
@ -466,18 +466,15 @@ if (do_write) {
if (length(candidate_entries) == 1L) "entry" else "entries" if (length(candidate_entries) == 1L) "entry" else "entries"
) )
) )
# Push with a write token when provided (CI); otherwise rely on origin creds. # Push over HTTPS with FORGEJO_TOKEN (same token used for the PR API), so no
rw_token <- Sys.getenv("REPO_RW_TOKEN") # separate write-scoped secret is needed. The read-only `origin` clone URL
push_target <- if (nchar(rw_token) > 0L) { # can't push, so build an authenticated URL explicitly.
sprintf( push_target <- sprintf(
"https://%s:%s@git.devxy.io/%s.git", "https://%s:%s@git.devxy.io/%s.git",
Sys.getenv("GIT_USER", "devxy-bot"), Sys.getenv("GIT_REMOTE_USER", "pat-s"),
rw_token, forgejo_token,
repo repo
) )
} else {
"origin"
}
git("push", "-f", push_target, sprintf("HEAD:refs/heads/%s", pr_branch)) git("push", "-f", push_target, sprintf("HEAD:refs/heads/%s", pr_branch))
pr_title <- sprintf( pr_title <- sprintf(