From ab1227514874b00454c126e6773efecd5d736e1a Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 30 Oct 2026 10:41:03 +0000 Subject: [PATCH 1/2] Drop bin/.keep and sync the fork with upstream daily The claude.ai marketplace sync refuses a plugin with a top-level bin/ directory, so this fork removes bin/.keep (make build already runs mkdir -p bin). A daily workflow merges basecamp/hey-cli main back in. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_015M5PY1MjeCoBFPSsz8HAzb --- .github/workflows/fork-sync-upstream.yml | 28 ++++++++++++++++++++++++ bin/.keep | 0 2 files changed, 28 insertions(+) create mode 100644 .github/workflows/fork-sync-upstream.yml delete mode 100644 bin/.keep diff --git a/.github/workflows/fork-sync-upstream.yml b/.github/workflows/fork-sync-upstream.yml new file mode 100644 index 000000000..b46bd205c --- /dev/null +++ b/.github/workflows/fork-sync-upstream.yml @@ -0,0 +1,28 @@ +# Fork-only: keeps justanotherspy/hey-cli's main current with basecamp/hey-cli. +# +# This fork exists for one reason: it drops bin/.keep, because the claude.ai +# marketplace sync refuses a plugin with a top-level bin/ directory. Everything +# else comes from upstream, merged in daily. +# +# Needs the FORK_SYNC_TOKEN secret: a fine-grained PAT on this repository with +# Contents and Workflows read/write. GITHUB_TOKEN cannot push upstream commits +# that change .github/workflows, so it is not enough. +name: Sync fork with upstream + +on: + schedule: + - cron: '23 5 * * *' + workflow_dispatch: + +permissions: {} + +jobs: + sync: + if: github.repository == 'justanotherspy/hey-cli' + runs-on: ubuntu-latest + steps: + - name: Merge basecamp/hey-cli main into main + env: + GH_TOKEN: ${{ secrets.FORK_SYNC_TOKEN }} + REPO: ${{ github.repository }} + run: gh api --method POST "repos/${REPO}/merge-upstream" -f branch=main diff --git a/bin/.keep b/bin/.keep deleted file mode 100644 index e69de29bb..000000000 From 91de2e37cc13a6530310d17fa445c120dff2f728 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 30 Oct 2026 10:42:01 +0000 Subject: [PATCH 2/2] Mint the fork-sync token with octo-sts instead of a PAT Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_015M5PY1MjeCoBFPSsz8HAzb --- .github/chainguard/fork-sync.sts.yaml | 17 +++++++++++++++++ .github/workflows/fork-sync-upstream.yml | 17 ++++++++++++----- 2 files changed, 29 insertions(+), 5 deletions(-) create mode 100644 .github/chainguard/fork-sync.sts.yaml diff --git a/.github/chainguard/fork-sync.sts.yaml b/.github/chainguard/fork-sync.sts.yaml new file mode 100644 index 000000000..ac1f43564 --- /dev/null +++ b/.github/chainguard/fork-sync.sts.yaml @@ -0,0 +1,17 @@ +# yaml-language-server: $schema=https://raw.githubusercontent.com/octo-sts/app/refs/heads/main/pkg/octosts/octosts.TrustPolicy.json + +# Fork-only: lets the "Sync fork with upstream" workflow on main mint a +# short-lived token to merge basecamp/hey-cli into this fork's main. +# +# Workflows write is needed because upstream commits often touch +# .github/workflows, which GITHUB_TOKEN can never push. +# +# The scheduled and manual runs both run on refs/heads/main, so this matches +# exactly. If this repository opts in to GitHub's immutable OIDC subject, the +# subject becomes repo:justanotherspy@4822513/hey-cli@:ref:refs/heads/main. +issuer: https://token.actions.githubusercontent.com +subject: repo:justanotherspy/hey-cli:ref:refs/heads/main + +permissions: + contents: write + workflows: write diff --git a/.github/workflows/fork-sync-upstream.yml b/.github/workflows/fork-sync-upstream.yml index b46bd205c..25ee09cbe 100644 --- a/.github/workflows/fork-sync-upstream.yml +++ b/.github/workflows/fork-sync-upstream.yml @@ -4,9 +4,9 @@ # marketplace sync refuses a plugin with a top-level bin/ directory. Everything # else comes from upstream, merged in daily. # -# Needs the FORK_SYNC_TOKEN secret: a fine-grained PAT on this repository with -# Contents and Workflows read/write. GITHUB_TOKEN cannot push upstream commits -# that change .github/workflows, so it is not enough. +# The token comes from octo-sts (trust policy: .github/chainguard/fork-sync.sts.yaml), +# not a stored secret: GITHUB_TOKEN cannot push upstream commits that change +# .github/workflows, and a short-lived token beats a long-lived PAT. name: Sync fork with upstream on: @@ -14,15 +14,22 @@ on: - cron: '23 5 * * *' workflow_dispatch: -permissions: {} +permissions: + id-token: write jobs: sync: if: github.repository == 'justanotherspy/hey-cli' runs-on: ubuntu-latest steps: + - uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1 + id: sts + with: + scope: justanotherspy/hey-cli + identity: fork-sync + - name: Merge basecamp/hey-cli main into main env: - GH_TOKEN: ${{ secrets.FORK_SYNC_TOKEN }} + GH_TOKEN: ${{ steps.sts.outputs.token }} REPO: ${{ github.repository }} run: gh api --method POST "repos/${REPO}/merge-upstream" -f branch=main