Rebase pushes with the machine-user PAT (action-translation#125)#17
Conversation
Commits pushed with the default GITHUB_TOKEN trigger no workflows, so a rebased branch gets a run-less head: force-pushed re-translated content lands unreviewed, and with required checks a run-less head blocks merging. Measured both ways on the test harness 2026-07-21 — zero runs under GITHUB_TOKEN, review triggered under the PAT. Sync mode has always passed the PAT for exactly this reason; rebase pushing to the same PRs with a weaker token was an inconsistency, not a decision. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR updates the translation rebase workflow to push rebased commits using a machine-user PAT instead of GITHUB_TOKEN, ensuring the resulting force-pushed heads trigger downstream workflows (and therefore required status checks).
Changes:
- Switch the
github-tokeninput forQuantEcon/action-translation@v0fromsecrets.GITHUB_TOKENtosecrets.QUANTECON_SERVICES_PAT. - Add inline documentation explaining why the PAT is required (workflow recursion guard behavior with
GITHUB_TOKEN).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }} | ||
| github-token: ${{ secrets.GITHUB_TOKEN }} | ||
| # PAT rather than the default GITHUB_TOKEN, deliberately: commits pushed | ||
| # with GITHUB_TOKEN trigger no workflows (GitHub's recursion guard), so a | ||
| # rebased branch ends up with a run-less head — force-pushed re-translated | ||
| # content lands unreviewed, and with required checks a run-less head blocks |
There was a problem hiding this comment.
Accepted, with one correction to the framing: the PAT was never exposed to fork PRs — GitHub withholds secrets from pull_request workflows triggered from forks regardless of repo visibility, so the security half of this doesn't apply. What IS right is the noise half: a merged fork PR whose branch happened to match a translation prefix would start this job with an empty token and fail red on a merged PR. The head-repo check skips it instead — belt-and-braces plus noise elimination, worth having on a PAT-bearing workflow.
Because this file mirrors the upstream template, the fix went everywhere at once rather than only here: the template (action-translation#130), both harness targets, the still-open python.zh-cn#187 (amended), and follow-up PRs on the four already-merged copies (this repo's is #18).
📖 Netlify Preview Ready!Preview URL: https://pr-17--verdant-toffee-3261a8.netlify.app Commit: Build Info
|
Completes the production half of action-translation#125: the rebase workflow now pushes with the machine-user PAT instead of the default
GITHUB_TOKEN.Why
Commits pushed with
GITHUB_TOKENdo not trigger workflows — GitHub's recursion guard — so a rebased branch ends up with a run-less head: force-pushed re-translated content lands unreviewed, and with required status checks a run-less head blocks merging. Measured both ways on the test harness, same repo, same day: 13GITHUB_TOKEN-rebased heads with zero workflow runs, versus a PAT-refreshed head whose review workflow triggered normally.This is the same reasoning sync mode has always applied — its PRs trigger the review workflow because it passes the PAT. Rebase pushing to the same PRs with a weaker token was an inconsistency, not a decision.
Safety
closed; the runs a PAT push triggers (CI, review) never push back.pull_requestworkflows triggered from forks regardless of repo visibility, and the job'sifonly matches branch prefixes the tooling creates.Input required and not supplied: github-token).The harness (
test-translation-sync.zh-cn) has carried this exact configuration in steady state since validation.🤖 Generated with Claude Code