From 2367cc00f16e469ba9827488fd2cabaf98d33754 Mon Sep 17 00:00:00 2001 From: Ariadne Conill Date: Thu, 8 Oct 2026 15:37:11 -0700 Subject: [PATCH] automation: use REBASE_FEDERATION_RULE_ID for the rebase The rebase runs from a scheduled or dispatched event and needs its own federation rule rather than the organization-wide one, so read it from vars.REBASE_FEDERATION_RULE_ID. --- .github/workflows/kernel-nightly.yml | 12 ++++++------ .github/workflows/upstream-rebase.yml | 6 +++--- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/kernel-nightly.yml b/.github/workflows/kernel-nightly.yml index 3e9737567feb02..09be7062f90f45 100644 --- a/.github/workflows/kernel-nightly.yml +++ b/.github/workflows/kernel-nightly.yml @@ -17,12 +17,12 @@ name: Nightly kernel maintenance # commits that touch .github/workflows/ (every rebase rewrites the ones # that add them), and pull requests it opens do not trigger other # workflows. -# vars.ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_ORGANIZATION_ID, -# ANTHROPIC_SERVICE_ACCOUNT_ID, ANTHROPIC_WORKSPACE_ID -# Organization-wide workload identity federation for the Claude API. The -# rule must accept this workflow's OIDC subject (a scheduled run on -# edera/6.18-lts), which a rule written for pull_request events will -# not. +# vars.REBASE_FEDERATION_RULE_ID +# The workload identity federation rule for the rebase. It must accept +# this workflow's OIDC subject (a scheduled or dispatched run). +# vars.ANTHROPIC_ORGANIZATION_ID, ANTHROPIC_SERVICE_ACCOUNT_ID, +# ANTHROPIC_WORKSPACE_ID +# The rest of the Claude API federation identity. on: schedule: diff --git a/.github/workflows/upstream-rebase.yml b/.github/workflows/upstream-rebase.yml index fdbdacbd19fa4c..75056019338fdf 100644 --- a/.github/workflows/upstream-rebase.yml +++ b/.github/workflows/upstream-rebase.yml @@ -195,7 +195,7 @@ jobs: - name: Normalize identifiers id: ids env: - RULE: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }} + RULE: ${{ vars.REBASE_FEDERATION_RULE_ID }} ORG: ${{ vars.ANTHROPIC_ORGANIZATION_ID }} SVC: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }} WS: ${{ vars.ANTHROPIC_WORKSPACE_ID }} @@ -211,10 +211,10 @@ jobs: # An unset variable otherwise surfaces as an opaque API failure a # second into the model step, with nothing in the log to say why. missing=0 - for n in FEDERATION_RULE_ID:RULE ORGANIZATION_ID:ORG SERVICE_ACCOUNT_ID:SVC WORKSPACE_ID:WS; do + for n in REBASE_FEDERATION_RULE_ID:RULE ANTHROPIC_ORGANIZATION_ID:ORG ANTHROPIC_SERVICE_ACCOUNT_ID:SVC ANTHROPIC_WORKSPACE_ID:WS; do eval "v=\$${n#*:}" if [ -z "$(strip "$v")" ]; then - echo "::error::vars.ANTHROPIC_${n%%:*} is empty or not visible to this repository." + echo "::error::vars.${n%%:*} is empty or not visible to this repository." missing=1 fi done