Skip to content

Rebase pushes with the machine-user PAT (action-translation#125) #74

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mmcky merged 1 commit into from
Jul 21, 2026
Merged

Rebase pushes with the machine-user PAT (action-translation#125) #74

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 10 additions & 3 deletions .github/workflows/rebase-translations.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
# When a translation PR is merged, this workflow automatically rebases the
# other open translation PRs against the updated main branch. It covers both
# kinds this tool creates: `translation-sync-*` branches from the Action's sync
# mode, and `resync/*` branches from the CLI's `forward --github`.
# mode, and `resync/*` branches from the CLI's `translate forward --github`.
#
# This eliminates merge conflicts caused by multiple upstream PRs
# modifying the same files. See: https://github.com/QuantEcon/action-translation/issues/63
Expand All @@ -20,7 +20,7 @@ on:
jobs:
rebase:
# Only run when a translation PR is merged. Both prefixes must be listed:
# sync mode creates `translation-sync-*`, while the CLI's `forward --github`
# sync mode creates `translation-sync-*`, while the CLI's `translate forward --github`
# creates `resync/*`, and a wave of resync PRs goes stale the same way.
# Keep this in step with `isTranslationBranch` in the action's src/branch-naming.ts
# — this `if` decides whether the job runs, that predicate decides which open PRs
Expand All @@ -46,4 +46,11 @@ jobs:
with:
mode: rebase
anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
github-token: ${{ secrets.GITHUB_TOKEN }}
# PAT rather than the default GITHUB_TOKEN, deliberately: commits pushed
# with GITHUB_TOKEN trigger no workflows (GitHub's recursion guard), so a
# rebased branch ends up with a run-less head — force-pushed re-translated
# content lands unreviewed, and with required checks a run-less head blocks
# merging. Validated both ways on the test harness, 2026-07-21: zero runs
# under GITHUB_TOKEN, review triggered under the PAT.
Comment on lines +53 to +54

@mmcky mmcky Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Deliberately keeping the date — pushing back on this one. The date is provenance, not staleness: it tells a future maintainer when the evidence was gathered and pairs with the linked issue where the runs live. This program's convention is dated empirical claims for exactly one reason: the last undated, "qualitative" rationale in this workflow family — .fa's old cancel-in-progress: false comment — was reasoned-sounding, timeless-sounding, and wrong, and it survived precisely because nothing marked when (or whether) it had ever been tested. Production disproved it across ~15 events. A dated claim invites re-verification when it ages; an undated one reads as eternal truth. If the claim is ever invalidated, the fix is to update the comment with the new evidence and its date, not to remove the timestamp that made the original auditable.

# See QuantEcon/action-translation#125.
github-token: ${{ secrets.QUANTECON_SERVICES_PAT }}
Comment on lines +55 to +56

@mmcky mmcky Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pushing back — the property this asks for already exists, and it was field-tested this week rather than assumed. github-token is a required input in action.yml, so an empty resolution fails immediately with the input named: Input required and not supplied: github-token. We observed exactly that live when the org-secret grant was missing on a harness target (first validation attempt of action-translation#124) — the failure was instant and self-explanatory, and the rerun after the grant succeeded from the same event. A per-repo preflight step would restate action.yml's own check while adding template-divergent boilerplate to five copies. Also note the most plausible route to a withheld secret — a fork-origin run — is now skipped entirely by the same-repo head guard added from the other review comment (#130 and estate follow-ups).

Loading