[getappz]

The `Update Scoop` job in release.yml pushed the manifest straight to `master` using an admin PAT, relying on `enforce_admins` being off. It's now on (`gh api repos/getappz/agentflare/branches/master/protection` confirms it), so both the v1.3.1 and v1.4.0 releases hit `GH006: Protected branch update failed`.

Fix: the job now creates a branch, opens a PR, and auto-merges it (0 required approvals, so it merges as soon as required checks pass) — same end result, but goes through the normal PR flow instead of trying to bypass branch protection. Still uses the owner PAT (`CLA_SIGNATURES_TOKEN`) since `GITHUB_TOKEN`-authored branch pushes don't trigger the required CI checks.

Summary by CodeRabbit

• Bug Fixes
  • Scoop manifest updates now use a pull request workflow instead of direct commits to the main branch.
  • Releases with no manifest changes now skip unnecessary updates.
  • Manifest update pull requests are automatically merged and their temporary branches removed.

[coderabbitai]

📝 Walkthrough

Walkthrough

The release workflow now updates the Scoop manifest by creating and automatically merging a pull request from a versioned branch, with expanded pull request permissions and an early exit when no manifest changes are detected.

Changes

Scoop manifest update

Layer / File(s)	Summary
Workflow permissions and update entrypoint .github/workflows/release.yml	The update-scoop job adds pull-requests: write permission, updates checkout comments, and renames the manifest update step.
Branch, pull request, and merge flow .github/workflows/release.yml	The workflow skips unchanged manifests, creates and pushes a versioned branch, opens a pull request against master, then auto-squash merges it and deletes the branch using the configured token.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant update_scoop as update-scoop job
  participant manifest as bucket/agentflare.json
  participant github as GitHub repository
  update_scoop->>manifest: Check for manifest changes
  update_scoop->>github: Push scoop-manifest-${VERSION} branch
  update_scoop->>github: Create pull request targeting master
  update_scoop->>github: Auto-squash merge and delete branch

Loading

Possibly related PRs

• getappz/agentflare#199: Both changes modify Scoop manifest generation in .github/workflows/release.yml.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the change and rationale, but it omits the template's required Test plan and Notes for reviewers sections.	Add the Test plan checklist and Notes for reviewers sections, including risk areas and backward compatibility notes.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: routing Scoop manifest updates through a PR instead of a direct push.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/scoop-release-pr

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release.yml:
- Around line 198-200: Update the release workflow permissions block to grant
the token used by CLA_SIGNATURES_TOKEN pull-request write access, while
retaining contents write access. Ensure the relevant pull-request permission is
configured for the fine-grained PAT documented in the CLA workflow.
- Around line 263-266: Update the release workflow around the gh pr create and
gh pr merge commands to make the approval requirement explicit: either provision
a trusted, distinct approver so auto-merge can complete hands-off, or
remove/defer automatic merging and add a manual approval step before merging the
generated Scoop manifest PR.
- Around line 258-266: Update the Scoop release flow around the branch variable
and gh pr create/merge commands to detect an existing open PR for the
scoop-manifest-${VERSION} branch, reuse its PR number or reference, and skip
creation when found. For a new branch PR, retain the current creation behavior;
in both cases, invoke gh pr merge on the existing PR head with the current auto,
squash, and delete-branch options.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: ff7f9da1-8e80-479e-9b88-3e9b1facd2ca

📥 Commits

Reviewing files that changed from the base of the PR and between 981c03b and 46dd2b6.

📒 Files selected for processing (1)

• .github/workflows/release.yml

[coderabbitai]

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail
rg -n -C3 'CLA_SIGNATURES_TOKEN|Contents:' \
  .github/workflows/cla.yml .github/workflows/release.yml

Repository: getappz/agentflare

Length of output: 2168

---

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

sed -n '180,220p' .github/workflows/release.yml
printf '\n----\n'
sed -n '250,275p' .github/workflows/release.yml
printf '\n----\n'
sed -n '30,45p' .github/workflows/cla.yml

Repository: getappz/agentflare

Length of output: 3756

---

🌐 Web query:

GitHub fine-grained personal access token permissions create pull request pull requests write contents write gh pr create

💡 Result:

To use the GitHub CLI (gh) command gh pr create with a fine-grained personal access token (PAT), you must configure specific repository permissions [1]. For the most basic pull request creation, you require the following minimum permissions: 1. Pull Requests: Read and write [1] 2. Metadata: Read-only (This is automatically added as a mandatory requirement when you select 'Pull Requests: Read and write') [1] While the core functionality for creating a PR is covered by these, users often encounter errors (such as inability to access repository metadata or branch references) if their token lacks broader access [1]. If you encounter errors like "Resource not accessible by personal access token," it is recommended to also include: - Contents: Read-only (or Read and write, depending on your broader workflow needs) [1] Additional notes: - Using 'write' access automatically includes 'read' access for that permission [2]. - If you use features like --project (adding a PR to a project), you will need additional permissions such as Project (read) [3][4]. - The GitHub CLI does not always explicitly inform you which specific fine-grained permission is missing due to API limitations [1]. If a command fails unexpectedly, verify your token's configured permissions in your GitHub settings under Personal Access Tokens [2].

Citations:

• 1: Detect missing fine grain permission scopes, notify user on steps to take to refresh scopes cli/cli#9403
• 2: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens
• 3: https://cli.github.com/manual/gh%5Fpr%5Fcreate
• 4: Cannot use fine-grained PATs to add labels to pull requests cli/cli#9166

---

Grant CLA_SIGNATURES_TOKEN pull-request access. gh pr create and gh pr merge use GH_TOKEN, so the job’s permissions block only affects GITHUB_TOKEN. The fine-grained PAT documented in .github/workflows/cla.yml needs Pull Requests: write in addition to Contents: write.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml around lines 198 - 200, Update the release
workflow permissions block to grant the token used by CLA_SIGNATURES_TOKEN
pull-request write access, while retaining contents write access. Ensure the
relevant pull-request permission is configured for the fine-grained PAT
documented in the CLA workflow.

[coderabbitai]

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail
VERSION="${1:?usage: $0 <version>}"
BRANCH="scoop-manifest-${VERSION}"

git ls-remote --heads origin "refs/heads/${BRANCH}"
gh pr list --repo getappz/agentflare --base master --head "${BRANCH}" \
  --state open --json number,url,headRefOid

Repository: getappz/agentflare

Length of output: 195

---

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

# Locate the workflow and inspect the relevant section with line numbers.
git ls-files '.github/workflows/release.yml'
wc -l .github/workflows/release.yml
sed -n '230,290p' .github/workflows/release.yml

Repository: getappz/agentflare

Length of output: 2372

---

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

# Inspect the workflow around the manifest publishing steps.
sed -n '1,230p' .github/workflows/release.yml

Repository: getappz/agentflare

Length of output: 8557

---

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT

git init --bare "$tmp/remote.git" >/dev/null
git clone "$tmp/remote.git" "$tmp/a" >/dev/null
cd "$tmp/a"
git config user.name "bot"
git config user.email "bot@example.com"

mkdir -p bucket
echo '{"version":"1.2.3"}' > bucket/agentflare.json
git add bucket/agentflare.json
git commit -m "scoop manifest: agentflare 1.2.3" >/dev/null
git branch -M master
git push origin master:scoop-manifest-1.2.3 >/dev/null

git clone "$tmp/remote.git" "$tmp/b" >/dev/null
cd "$tmp/b"
git config user.name "bot"
git config user.email "bot@example.com"

git checkout -b master origin/master >/dev/null
mkdir -p bucket
echo '{"version":"1.2.3"}' > bucket/agentflare.json
git add bucket/agentflare.json
git commit -m "scoop manifest: agentflare 1.2.3" >/dev/null

set +e
git push origin HEAD:scoop-manifest-1.2.3
code=$?
set -e

echo "exit=$code"

Repository: getappz/agentflare

Length of output: 1122

---

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT

git init --bare "$tmp/remote.git" >/dev/null
git clone "$tmp/remote.git" "$tmp/repo" >/dev/null
cd "$tmp/repo"
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]`@users.noreply.github.com`"

# Base branch that mimics the workflow checkout.
echo base > README.md
git add README.md
git commit -m "base" >/dev/null
git branch -M master
git push origin master >/dev/null

make_commit() {
  rm -rf bucket
  mkdir -p bucket
  printf '%s\n' '{"version":"1.2.3","hash":"sha256:abc"}' > bucket/agentflare.json
  git add bucket/agentflare.json
  git commit -m "scoop manifest: agentflare 1.2.3" >/dev/null
  git rev-parse HEAD
}

git checkout -b scoop-manifest-1.2.3 master >/dev/null
sha1="$(make_commit)"
git push origin HEAD:scoop-manifest-1.2.3 >/dev/null

git checkout master >/dev/null
git branch -D scoop-manifest-1.2.3 >/dev/null
git checkout -b scoop-manifest-1.2.3 master >/dev/null
sha2="$(make_commit)"

set +e
git push origin HEAD:scoop-manifest-1.2.3
push_exit=$?
set -e

printf 'sha1=%s\nsha2=%s\npush_exit=%s\n' "$sha1" "$sha2" "$push_exit"

Repository: getappz/agentflare

Length of output: 1098

---

🌐 Web query:

gh pr create existing branch already has a pull request behavior open source documentation

💡 Result:

When using the GitHub CLI (gh), the gh pr create command is designed to prevent the creation of duplicate pull requests [1][2]. If an open pull request already exists for the same head branch and base branch, the command will fail and output an error message containing the URL of the existing pull request [1][3][4]. Because gh pr create does not automatically "upsert" (update) an existing pull request, users seeking to maintain or update an existing PR typically employ one of the following strategies in their scripts: 1. Manual Update: If a PR already exists, the intended changes are usually pushed via git push (or git push --force if necessary), which automatically updates the open pull request associated with that branch [3][5]. 2. Conditional Logic: Scripts often check for an existing PR before running the create command [3][5]. A common pattern is to attempt to list the PR for the current branch first; if one is found, the script can then use gh pr edit to update metadata (such as the title or body) instead of trying to create a new one [3][5]. The command does not currently provide a specific flag to automatically update an existing PR, nor does it return a unique exit code specifically for an "already exists" state, making it necessary to parse the error output or check for the PR existence programmatically if automated handling is required [3][5].

Citations:

• 1: https://github.com/cli/cli/blob/trunk/pkg/cmd/pr/create/create.go
• 2: pr create shoud fail faster if a PR already exists cli/cli#649
• 3: gh pr create should detect and update already existing pull requests cli/cli#5792
• 4: gh pr create duplicate even if different bases cli/cli#718
• 5: Different exit code for gh pr create if pull request already exists cli/cli#13571

---

Reuse the existing Scoop PR on reruns. The branch recreation already lands on the same commit, but gh pr create will fail once an open PR exists for scoop-manifest-${VERSION}. Look up that PR and reuse it, then enable merge on the existing head instead of creating a new one.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml around lines 258 - 266, Update the Scoop
release flow around the branch variable and gh pr create/merge commands to
detect an existing open PR for the scoop-manifest-${VERSION} branch, reuse its
PR number or reference, and skip creation when found. For a new branch PR,
retain the current creation behavior; in both cases, invoke gh pr merge on the
existing PR head with the current auto, squash, and delete-branch options.

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail
gh api repos/getappz/agentflare/branches/master/protection/required_pull_request_reviews \
  --jq '{required_approving_review_count,require_code_owner_reviews,require_last_push_approval}'

Repository: getappz/agentflare

Length of output: 390

---

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

# Show the relevant workflow section with line numbers.
sed -n '190,280p' .github/workflows/release.yml | cat -n

# Look for repository-side branch protection / ruleset config.
git ls-files .github | sed -n '1,200p'
rg -n "required_approving_review_count|require_code_owner_reviews|require_last_push_approval|review|auto-merge|gh pr merge|master" .github -S

Repository: getappz/agentflare

Length of output: 5008

---

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

# Inspect the exact lines around the PR creation/merge logic.
nl -ba .github/workflows/release.yml | sed -n '200,270p'

# Search for any repo-local branch protection/ruleset config.
git ls-files | rg '(^|/)(branch-protection|ruleset|protection|settings)\.|\.github/.+(rules|protection)|CODEOWNERS$'
rg -n "required_approving_review_count|require_code_owner_reviews|require_last_push_approval|auto-merge|gh pr merge|gh pr create|master" -S .github . 2>/dev/null

Repository: getappz/agentflare

Length of output: 196

---

gh pr merge --auto still depends on a separate approval. .github/workflows/release.yml already notes that master requires an approved PR plus passing checks, so this PR will remain pending until a distinct reviewer approves it. If this is meant to be hands-off, provision a trusted approver; otherwise make manual approval an explicit release step.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml around lines 263 - 266, Update the release
workflow around the gh pr create and gh pr merge commands to make the approval
requirement explicit: either provision a trusted, distinct approver so
auto-merge can complete hands-off, or remove/defer automatic merging and add a
manual approval step before merging the generated Scoop manifest PR.