Repository navigation
Publish generated bot catalogs through verified PRs - #20
Merged
Merged
Conversation
Contributor
|
@flemming-n-larsen Moderation needs your decision for The required check stays pending. After reviewing, use |
Contributor
|
@flemming-n-larsen Moderation needs your decision for The required check stays pending. After reviewing, use |
Contributor
|
@flemming-n-larsen Moderation needs your decision for The required check stays pending. After reviewing, use |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The catalog publisher currently pushes generated JSON directly to
main, so the required pull-request rule would break publication. After a clean bot merge, the moderator App now pushes a generated catalog branch; a separate Publisher App opens its PR. A credential-free workflow verifies the source bot's moderation result and regenerates the exact catalog files from trustedmain. The moderator App approves and merges only that verified head. Catalog merges do not trigger another publication run.The organization forbids
GITHUB_TOKENfrom creating PRs, so the Publisher App has only Contents read and Pull requests write onrumble-bots; it gets no push or bypass permission.GOVERNANCE.mddocuments its exact registration and two new repository secrets. Generated files no longer require Flemming as CODEOWNER; workflow and policy changes still do. If multiple bot submissions are unpublished at once, verification holds the catalog PR for ownership review.Validation: 46 Python tests passed (2 platform-dependent skips);
git diff --checkpassed. Live publication and branch-rule activation remain on hold until the Publisher App is installed and a generated PR is observed end to end.