Skip to content

Rebase pushes with the machine-user PAT (action-translation#125) #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mmcky merged 1 commit into from
Jul 21, 2026
Merged

Rebase pushes with the machine-user PAT (action-translation#125) #17

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion .github/workflows/rebase-translations.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,4 +46,11 @@ jobs:
with:
mode: rebase
anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
github-token: ${{ secrets.GITHUB_TOKEN }}
# PAT rather than the default GITHUB_TOKEN, deliberately: commits pushed
# with GITHUB_TOKEN trigger no workflows (GitHub's recursion guard), so a
# rebased branch ends up with a run-less head — force-pushed re-translated
# content lands unreviewed, and with required checks a run-less head blocks
Comment on lines 48 to +52

@mmcky mmcky Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Accepted, with one correction to the framing: the PAT was never exposed to fork PRs — GitHub withholds secrets from pull_request workflows triggered from forks regardless of repo visibility, so the security half of this doesn't apply. What IS right is the noise half: a merged fork PR whose branch happened to match a translation prefix would start this job with an empty token and fail red on a merged PR. The head-repo check skips it instead — belt-and-braces plus noise elimination, worth having on a PAT-bearing workflow.

Because this file mirrors the upstream template, the fix went everywhere at once rather than only here: the template (action-translation#130), both harness targets, the still-open python.zh-cn#187 (amended), and follow-up PRs on the four already-merged copies (this repo's is #18).

# merging. Validated both ways on the test harness, 2026-07-21: zero runs
# under GITHUB_TOKEN, review triggered under the PAT.
# See QuantEcon/action-translation#125.
github-token: ${{ secrets.QUANTECON_SERVICES_PAT }}
Loading