ci(nightly): push with yngatech-nightly app token - #92
Merged
Conversation
Pushes authenticated with FORK_RELEASE_TOKEN, a personal access token with no bypass on main's PR + CI ruleset, so the promotion push to main was rejected with GH013 after the release published. Mint an installation token for the yngatech-nightly GitHub App — the ruleset's bypass actor — at the start of each pushing job and check out with it instead. Minted per job because installation tokens expire after one hour and the desktop builds sit between prepare and release. The app and its credentials were already provisioned; only the workflow was missing.
github-actions
Bot
added
size:S
vouch:trusted
This was referenced Aug 11, 2026
incognitojam
added a commit
that referenced
this pull request
Aug 11, 2026
## Problem The `source_ref` dispatch that fixed the conflicted patch stack promoted a resolution cut before today's workflow PRs merged, rolling `main`'s workflow state back: #87 (promote every verified run), #90 (require workflow jobs directly), #91 (`source_ref` input), and #92 (yngatech-nightly app token) were dropped. The moved-main lease only guards movement during a run, not whether the provided stack already contained everything on `main`. ## Fix Cherry-pick the four squash commits back onto the promoted stack, in original merge order. The restored `.github/workflows/fork-nightly.yml`, `.github/workflows/fork-ci.yml`, and `docs/operations/fork-nightly.md` are byte-identical to their pre-rollback state (verified with `git diff` against the old `main` tip). A follow-up should make `source_ref` runs fail when the provided stack is missing patches present on `main` (patch-id comparison in prepare). --- Written by an agent (Claude Code, claude-fable-5).
yngatech-nightly Bot
pushed a commit
that referenced
this pull request
Aug 11, 2026
## Problem The `source_ref` dispatch that fixed the conflicted patch stack promoted a resolution cut before today's workflow PRs merged, rolling `main`'s workflow state back: #87 (promote every verified run), #90 (require workflow jobs directly), #91 (`source_ref` input), and #92 (yngatech-nightly app token) were dropped. The moved-main lease only guards movement during a run, not whether the provided stack already contained everything on `main`. ## Fix Cherry-pick the four squash commits back onto the promoted stack, in original merge order. The restored `.github/workflows/fork-nightly.yml`, `.github/workflows/fork-ci.yml`, and `docs/operations/fork-nightly.md` are byte-identical to their pre-rollback state (verified with `git diff` against the old `main` tip). A follow-up should make `source_ref` runs fail when the provided stack is missing patches present on `main` (patch-id comparison in prepare). --- Written by an agent (Claude Code, claude-fable-5).
yngatech-nightly Bot
pushed a commit
that referenced
this pull request
Aug 12, 2026
## Problem The `source_ref` dispatch that fixed the conflicted patch stack promoted a resolution cut before today's workflow PRs merged, rolling `main`'s workflow state back: #87 (promote every verified run), #90 (require workflow jobs directly), #91 (`source_ref` input), and #92 (yngatech-nightly app token) were dropped. The moved-main lease only guards movement during a run, not whether the provided stack already contained everything on `main`. ## Fix Cherry-pick the four squash commits back onto the promoted stack, in original merge order. The restored `.github/workflows/fork-nightly.yml`, `.github/workflows/fork-ci.yml`, and `docs/operations/fork-nightly.md` are byte-identical to their pre-rollback state (verified with `git diff` against the old `main` tip). A follow-up should make `source_ref` runs fail when the provided stack is missing patches present on `main` (patch-id comparison in prepare). --- Written by an agent (Claude Code, claude-fable-5).
yngatech-nightly Bot
pushed a commit
that referenced
this pull request
Aug 12, 2026
## Problem The `source_ref` dispatch that fixed the conflicted patch stack promoted a resolution cut before today's workflow PRs merged, rolling `main`'s workflow state back: #87 (promote every verified run), #90 (require workflow jobs directly), #91 (`source_ref` input), and #92 (yngatech-nightly app token) were dropped. The moved-main lease only guards movement during a run, not whether the provided stack already contained everything on `main`. ## Fix Cherry-pick the four squash commits back onto the promoted stack, in original merge order. The restored `.github/workflows/fork-nightly.yml`, `.github/workflows/fork-ci.yml`, and `docs/operations/fork-nightly.md` are byte-identical to their pre-rollback state (verified with `git diff` against the old `main` tip). A follow-up should make `source_ref` runs fail when the provided stack is missing patches present on `main` (patch-id comparison in prepare). --- Written by an agent (Claude Code, claude-fable-5).
yngatech-nightly Bot
pushed a commit
that referenced
this pull request
Aug 12, 2026
## Problem The `source_ref` dispatch that fixed the conflicted patch stack promoted a resolution cut before today's workflow PRs merged, rolling `main`'s workflow state back: #87 (promote every verified run), #90 (require workflow jobs directly), #91 (`source_ref` input), and #92 (yngatech-nightly app token) were dropped. The moved-main lease only guards movement during a run, not whether the provided stack already contained everything on `main`. ## Fix Cherry-pick the four squash commits back onto the promoted stack, in original merge order. The restored `.github/workflows/fork-nightly.yml`, `.github/workflows/fork-ci.yml`, and `docs/operations/fork-nightly.md` are byte-identical to their pre-rollback state (verified with `git diff` against the old `main` tip). A follow-up should make `source_ref` runs fail when the provided stack is missing patches present on `main` (patch-id comparison in prepare). --- Written by an agent (Claude Code, claude-fable-5).
yngatech-nightly Bot
pushed a commit
that referenced
this pull request
Aug 13, 2026
## Problem The `source_ref` dispatch that fixed the conflicted patch stack promoted a resolution cut before today's workflow PRs merged, rolling `main`'s workflow state back: #87 (promote every verified run), #90 (require workflow jobs directly), #91 (`source_ref` input), and #92 (yngatech-nightly app token) were dropped. The moved-main lease only guards movement during a run, not whether the provided stack already contained everything on `main`. ## Fix Cherry-pick the four squash commits back onto the promoted stack, in original merge order. The restored `.github/workflows/fork-nightly.yml`, `.github/workflows/fork-ci.yml`, and `docs/operations/fork-nightly.md` are byte-identical to their pre-rollback state (verified with `git diff` against the old `main` tip). A follow-up should make `source_ref` runs fail when the provided stack is missing patches present on `main` (patch-id comparison in prepare). --- Written by an agent (Claude Code, claude-fable-5).
yngatech-nightly Bot
pushed a commit
that referenced
this pull request
Aug 13, 2026
## Problem The `source_ref` dispatch that fixed the conflicted patch stack promoted a resolution cut before today's workflow PRs merged, rolling `main`'s workflow state back: #87 (promote every verified run), #90 (require workflow jobs directly), #91 (`source_ref` input), and #92 (yngatech-nightly app token) were dropped. The moved-main lease only guards movement during a run, not whether the provided stack already contained everything on `main`. ## Fix Cherry-pick the four squash commits back onto the promoted stack, in original merge order. The restored `.github/workflows/fork-nightly.yml`, `.github/workflows/fork-ci.yml`, and `docs/operations/fork-nightly.md` are byte-identical to their pre-rollback state (verified with `git diff` against the old `main` tip). A follow-up should make `source_ref` runs fail when the provided stack is missing patches present on `main` (patch-id comparison in prepare). --- Written by an agent (Claude Code, claude-fable-5).
yngatech-nightly Bot
pushed a commit
that referenced
this pull request
Aug 13, 2026
## Problem The `source_ref` dispatch that fixed the conflicted patch stack promoted a resolution cut before today's workflow PRs merged, rolling `main`'s workflow state back: #87 (promote every verified run), #90 (require workflow jobs directly), #91 (`source_ref` input), and #92 (yngatech-nightly app token) were dropped. The moved-main lease only guards movement during a run, not whether the provided stack already contained everything on `main`. ## Fix Cherry-pick the four squash commits back onto the promoted stack, in original merge order. The restored `.github/workflows/fork-nightly.yml`, `.github/workflows/fork-ci.yml`, and `docs/operations/fork-nightly.md` are byte-identical to their pre-rollback state (verified with `git diff` against the old `main` tip). A follow-up should make `source_ref` runs fail when the provided stack is missing patches present on `main` (patch-id comparison in prepare). --- Written by an agent (Claude Code, claude-fable-5).
yngatech-nightly Bot
pushed a commit
that referenced
this pull request
Aug 13, 2026
## Problem The `source_ref` dispatch that fixed the conflicted patch stack promoted a resolution cut before today's workflow PRs merged, rolling `main`'s workflow state back: #87 (promote every verified run), #90 (require workflow jobs directly), #91 (`source_ref` input), and #92 (yngatech-nightly app token) were dropped. The moved-main lease only guards movement during a run, not whether the provided stack already contained everything on `main`. ## Fix Cherry-pick the four squash commits back onto the promoted stack, in original merge order. The restored `.github/workflows/fork-nightly.yml`, `.github/workflows/fork-ci.yml`, and `docs/operations/fork-nightly.md` are byte-identical to their pre-rollback state (verified with `git diff` against the old `main` tip). A follow-up should make `source_ref` runs fail when the provided stack is missing patches present on `main` (patch-id comparison in prepare). --- Written by an agent (Claude Code, claude-fable-5).
yngatech-nightly Bot
pushed a commit
that referenced
this pull request
Aug 14, 2026
## Problem The `source_ref` dispatch that fixed the conflicted patch stack promoted a resolution cut before today's workflow PRs merged, rolling `main`'s workflow state back: #87 (promote every verified run), #90 (require workflow jobs directly), #91 (`source_ref` input), and #92 (yngatech-nightly app token) were dropped. The moved-main lease only guards movement during a run, not whether the provided stack already contained everything on `main`. ## Fix Cherry-pick the four squash commits back onto the promoted stack, in original merge order. The restored `.github/workflows/fork-nightly.yml`, `.github/workflows/fork-ci.yml`, and `docs/operations/fork-nightly.md` are byte-identical to their pre-rollback state (verified with `git diff` against the old `main` tip). A follow-up should make `source_ref` runs fail when the provided stack is missing patches present on `main` (patch-id comparison in prepare). --- Written by an agent (Claude Code, claude-fable-5).
yngatech-nightly Bot
pushed a commit
that referenced
this pull request
Aug 14, 2026
## Problem The `source_ref` dispatch that fixed the conflicted patch stack promoted a resolution cut before today's workflow PRs merged, rolling `main`'s workflow state back: #87 (promote every verified run), #90 (require workflow jobs directly), #91 (`source_ref` input), and #92 (yngatech-nightly app token) were dropped. The moved-main lease only guards movement during a run, not whether the provided stack already contained everything on `main`. ## Fix Cherry-pick the four squash commits back onto the promoted stack, in original merge order. The restored `.github/workflows/fork-nightly.yml`, `.github/workflows/fork-ci.yml`, and `docs/operations/fork-nightly.md` are byte-identical to their pre-rollback state (verified with `git diff` against the old `main` tip). A follow-up should make `source_ref` runs fail when the provided stack is missing patches present on `main` (patch-id comparison in prepare). --- Written by an agent (Claude Code, claude-fable-5).
incognitojam
added a commit
that referenced
this pull request
Aug 15, 2026
## Problem The `source_ref` dispatch that fixed the conflicted patch stack promoted a resolution cut before today's workflow PRs merged, rolling `main`'s workflow state back: #87 (promote every verified run), #90 (require workflow jobs directly), #91 (`source_ref` input), and #92 (yngatech-nightly app token) were dropped. The moved-main lease only guards movement during a run, not whether the provided stack already contained everything on `main`. ## Fix Cherry-pick the four squash commits back onto the promoted stack, in original merge order. The restored `.github/workflows/fork-nightly.yml`, `.github/workflows/fork-ci.yml`, and `docs/operations/fork-nightly.md` are byte-identical to their pre-rollback state (verified with `git diff` against the old `main` tip). A follow-up should make `source_ref` runs fail when the provided stack is missing patches present on `main` (patch-id comparison in prepare). --- Written by an agent (Claude Code, claude-fable-5).
yngatech-nightly Bot
pushed a commit
that referenced
this pull request
Aug 18, 2026
## Problem The `source_ref` dispatch that fixed the conflicted patch stack promoted a resolution cut before today's workflow PRs merged, rolling `main`'s workflow state back: #87 (promote every verified run), #90 (require workflow jobs directly), #91 (`source_ref` input), and #92 (yngatech-nightly app token) were dropped. The moved-main lease only guards movement during a run, not whether the provided stack already contained everything on `main`. ## Fix Cherry-pick the four squash commits back onto the promoted stack, in original merge order. The restored `.github/workflows/fork-nightly.yml`, `.github/workflows/fork-ci.yml`, and `docs/operations/fork-nightly.md` are byte-identical to their pre-rollback state (verified with `git diff` against the old `main` tip). A follow-up should make `source_ref` runs fail when the provided stack is missing patches present on `main` (patch-id comparison in prepare). --- Written by an agent (Claude Code, claude-fable-5).
yngatech-nightly Bot
pushed a commit
that referenced
this pull request
Aug 18, 2026
## Problem The `source_ref` dispatch that fixed the conflicted patch stack promoted a resolution cut before today's workflow PRs merged, rolling `main`'s workflow state back: #87 (promote every verified run), #90 (require workflow jobs directly), #91 (`source_ref` input), and #92 (yngatech-nightly app token) were dropped. The moved-main lease only guards movement during a run, not whether the provided stack already contained everything on `main`. ## Fix Cherry-pick the four squash commits back onto the promoted stack, in original merge order. The restored `.github/workflows/fork-nightly.yml`, `.github/workflows/fork-ci.yml`, and `docs/operations/fork-nightly.md` are byte-identical to their pre-rollback state (verified with `git diff` against the old `main` tip). A follow-up should make `source_ref` runs fail when the provided stack is missing patches present on `main` (patch-id comparison in prepare). --- Written by an agent (Claude Code, claude-fable-5).
yngatech-nightly Bot
pushed a commit
that referenced
this pull request
Aug 18, 2026
## Problem The `source_ref` dispatch that fixed the conflicted patch stack promoted a resolution cut before today's workflow PRs merged, rolling `main`'s workflow state back: #87 (promote every verified run), #90 (require workflow jobs directly), #91 (`source_ref` input), and #92 (yngatech-nightly app token) were dropped. The moved-main lease only guards movement during a run, not whether the provided stack already contained everything on `main`. ## Fix Cherry-pick the four squash commits back onto the promoted stack, in original merge order. The restored `.github/workflows/fork-nightly.yml`, `.github/workflows/fork-ci.yml`, and `docs/operations/fork-nightly.md` are byte-identical to their pre-rollback state (verified with `git diff` against the old `main` tip). A follow-up should make `source_ref` runs fail when the provided stack is missing patches present on `main` (patch-id comparison in prepare). --- Written by an agent (Claude Code, claude-fable-5).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Fork Nightly authenticates its pushes through the checkout token, which was
secrets.FORK_RELEASE_TOKEN— a personal access token. The "PR + CI" ruleset onmainhas exactly one bypass actor: theyngatech-nightlyGitHub App. The PAT has no bypass, so the promotion push tomainfails with GH013. Run 31514413207 demonstrated the full failure shape: release published,nightlypromoted,mainpromotion rejected.Fix
Mint an installation token for the
yngatech-nightlyapp at the start of each job that pushes, and check out with it:mainon no-change days, plus thenightly-candidatepush) and the release job (nightly, the daily backup ref, andmain) get anapp_tokenstep usingactions/create-github-app-token, SHA-pinned to v3.2.0 per repo convention, followed bytoken: ${{ steps.app_token.outputs.token }}on the checkout.app-idin favor ofclient-id, which is what the pre-provisionedYNGATECH_NIGHTLY_APP_CLIENT_IDvariable holds, so the step usesclient-iddirectly (verified against the action's v3.2.0action.yml).Cameron pre-provisioned the app, the
YNGATECH_NIGHTLY_APP_CLIENT_IDvariable, and theYNGATECH_NIGHTLY_APP_PRIVATE_KEYsecret; only the workflow wiring was missing. No other behavior changes. After this lands,FORK_RELEASE_TOKENis referenced nowhere in.github/— these two checkouts were its only uses.Verified with actionlint (only the pre-existing Blacksmith runner-label warning) and by tracing every push in the workflow to one of the two app-token checkouts; the remaining
github.tokenuses (release notes, draft release, issue edit) touch no protected refs.Built by Fable 5 (claude-fable-5) on Claude Code.