Repository navigation
Use OctoSTS for release draft conversion - #1309
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Regression tests mock token issuance and GitHub authorization, leaving the live OctoSTS exchange and app-authorized draft conversion unverified until a fresh dispatch on updated main for PR #1307.
No open issues 🎉
What changed in this PR
Fixes release PR draft conversion after #1298 restricted the default workflow token. The conversion step now uses a fresh OctoSTS token while preserving the existing checkout and augmentation sequence.
Changes:
- Adds a dedicated OctoSTS token exchange immediately before draft conversion.
- Adds regression tests for ready PRs, already-draft PRs, and rejected mutations, and includes them in CI.
| File | Description |
|---|---|
scripts/upstream-release/workflow.test.mjs |
Tests draft conversion using workflow-resolved credentials and a stubbed GitHub CLI. |
.github/workflows/upstream-release-docs.yml |
Obtains and passes an OctoSTS token to the draft-conversion step. |
.github/workflows/_static-checks.yaml |
Runs the new workflow tests alongside release PR body tests. |
Review effort: Balanced
danbarr
enabled auto-merge (squash)
November 2, 2026 23:02
reyortiz3
approved these changes
Nov 2, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The trusted augment run for ToolHive v0.60.0 fails at
convertPullRequestToDraftwithResource not accessible by integration, before checking out the PR or refreshing any references. The draft-conversion step still inheritedGITHUB_TOKENafter #1298 reduced that token tocontents: read; all OctoSTS exchanges were either bootstrap-only or later in the job.Exchange a fresh OctoSTS token immediately before draft conversion and pass it only to that step. Reuse the existing release policy, which grants
contents: writeandpull_requests: write, while keeping the default job token's content access read-only. The PR checkout, generated-reference refresh, and Claude session sequence remain unchanged.Add a CI regression test that executes the workflow's draft-conversion shell with a stubbed GitHub CLI and resolves its token from the workflow configuration. It covers a ready PR, an already-draft PR, and a rejected mutation. The ready-PR test fails against the original workflow.
Type of change
Related issues/PRs
Validation
npm run buildgit diff --checkzizmor --offline .github/workflows .github/actions$/syntax diagnostics and existing ShellCheck style suggestionsLive OctoSTS exchange and draft conversion still need verification after merge. Dispatch a fresh run on updated
mainfor PR #1307; rerunning the failed run would use its original workflow revision.Submitter checklist
Content and formatting
Reviewer checklist
Content