Merge pull request #158 from WeOwnNetwork/fix/nik-openrouter-guard-ex… #614
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Auto-Create PR to Main | ||
|
Check failure on line 1 in .github/workflows/auto-pr-to-main.yml
|
||
| # Authors PRs as the ecosystem-wide `weown-bot` service account so that | ||
| # GitHub Copilot code review is auto-triggered (Copilot only reviews PRs | ||
| # authored by human-type accounts, not GitHub Apps). | ||
| # | ||
| # NOTE: For auto-created PRs (this workflow's pattern), commits are pushed to | ||
| # the branch BEFORE the PR is created. Because there is no new push delta at | ||
| # PR-creation time, Copilot's `review_on_push: true` does not fire on the | ||
| # initial PR. Any follow-up push to the SAME open PR triggers Copilot review | ||
| # automatically. This is expected and documented — see ADR-004 | ||
| # § Empirical Validation Results + Forward-looking posture for full analysis. | ||
| # For manually-created PRs where the PR is opened before commits are pushed, | ||
| # Copilot fires at PR-creation time as described in ADR-004. | ||
| # | ||
| # See: | ||
| # - .github/workflows/README.md (authoritative ops reference) | ||
| # - .github/ADR-001-service-account-pat.md | ||
| # - .github/ADR-002-infisical-github-sync.md | ||
| # - .github/copilot-instructions.md (phase-aware compliance directives) | ||
| on: | ||
| push: | ||
| branches: | ||
| - 'feature/*' | ||
| - 'fix/*' | ||
| - 'docs/*' | ||
| - 'hotfix/*' | ||
| # Manual trigger for debugging + PR-body refresh without needing an empty | ||
| # commit. Uses the same defense-in-depth branch-name regex guard in step 1, | ||
| # so dispatching on `main` or an unconventional branch exits safely. | ||
| workflow_dispatch: | ||
| inputs: | ||
| base: | ||
| description: "Target branch for the new PR (default main)" | ||
| required: false | ||
| default: "main" | ||
| type: string | ||
| # Serialize runs per-branch so rapid pushes don't race each other on | ||
| # `gh pr edit`. `cancel-in-progress: true` supersedes an older in-flight run | ||
| # when a newer push arrives — the PR body will always reflect the most | ||
| # recent push. Only cancels runs on the same branch; other branches are | ||
| # unaffected. | ||
| concurrency: | ||
| group: auto-pr-${{ github.ref }} | ||
| cancel-in-progress: true | ||
| # GITHUB_TOKEN permissions — intentionally minimal. | ||
| # Every `gh` command in this workflow uses WEOWN_BOT_PAT via GH_TOKEN (so PRs | ||
| # are authored by `weown-bot`, which is what makes Copilot auto-review trigger). | ||
| # actions/checkout also receives the PAT via its `token:` input. | ||
| # GITHUB_TOKEN is therefore effectively unused, but we grant `contents: read` | ||
| # as a defensive fallback in case a future step (e.g. a linter action) needs it. | ||
| # No `pull-requests: write` — PR ops go through the PAT, not GITHUB_TOKEN. | ||
| # Rationale: NIST PR.AC-3 (least privilege), CIS 5.4 (reduce blast radius). | ||
| permissions: | ||
| contents: read | ||
| jobs: | ||
| create-pr: | ||
| runs-on: ubuntu-latest | ||
| # Skip cleanly when the bot PAT is absent or expired rather than failing at | ||
| # checkout with "could not read Username". A workflow that is red on every | ||
| # branch teaches people to ignore red — which is how a real failure gets | ||
| # missed. Absent credential = not applicable, not broken. (WEOWN_BOT_PAT has | ||
| # been dead since 2026-07-29; see the Keycloak-Gitea board, row 20.) | ||
| if: ${{ secrets.WEOWN_BOT_PAT != '' }} | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | ||
| with: | ||
| fetch-depth: 0 | ||
| token: ${{ secrets.WEOWN_BOT_PAT }} | ||
| - name: Create or Update Pull Request | ||
| id: create-pr | ||
| env: | ||
| GH_TOKEN: ${{ secrets.WEOWN_BOT_PAT }} | ||
| GITHUB_SERVER_URL: ${{ github.server_url }} | ||
| GITHUB_REPOSITORY: ${{ github.repository }} | ||
| # Last-pusher attribution: triggering_actor handles workflow_dispatch | ||
| # + re-runs accurately (it's the user who clicked Run / Re-run); | ||
| # github.actor is the fallback for push events. For a plain push, | ||
| # both resolve to the pusher. `Opened by:` attribution is computed | ||
| # separately inside the run (step 6) from the FIRST commit on the | ||
| # branch — it is idempotent across pushes, unlike this env var. | ||
| LAST_PUSHED_BY: ${{ github.triggering_actor || github.actor }} | ||
| EVENT_NAME: ${{ github.event_name }} | ||
| DISPATCH_BASE: ${{ github.event.inputs.base }} | ||
| # github.ref_name reaches the script via this env var, not an inline | ||
| # ${{ }} in run: (a .sh file gets its context from the environment). | ||
| REF_NAME: ${{ github.ref_name }} | ||
| # Logic lives in .github/scripts/auto-pr.sh - keeps run: one line, makes | ||
| # the ~400-line script reviewable/shellcheck-linted, and makes GitHub's | ||
| # 21,000-char expression-length failure structurally impossible. | ||
| run: bash "$GITHUB_WORKSPACE/.github/scripts/auto-pr.sh" | ||
