Repository navigation
Use dedicated Publisher App for generated catalog PRs - #21
Merged
Merged
Conversation
Contributor
|
@flemming-n-larsen Moderation needs your decision for The required check stays pending. After reviewing, use |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub merged #20 before its final commit. This PR applies the missing organization-compatible publication path: the Moderator App pushes the generated branch, while a separate Publisher App opens the catalog PR. The Moderator App then verifies, approves, and merges the exact generated content. The Publisher App has only Contents read and Pull requests write access, avoiding the organization's prohibition on GITHUB_TOKEN-created PRs.
GOVERNANCE.md now links to a pre-filled Publisher App registration form and documents its repository-only installation and secrets. The workflow remains inactive until the App is installed and RUMBLE_PUBLISHER_APP_ID and RUMBLE_PUBLISHER_PRIVATE_KEY are configured. A live publication test and branch-rule activation follow that setup.
Validation: 46 Python tests passed (2 platform skips); git diff --check passed.