[release-23.0] CI: scope app tokens to steps instead of exporting via GITHUB_ENV (#20786) by vitess-bot[bot] · Pull Request #20797 · vitessio/vitess

vitess-bot · 2026-08-04T18:06:16Z

Description

This is a backport of #20786

vitess-bot · 2026-08-04T18:06:20Z

Hello @arthurschreiber, there are conflicts in this backport.

Please address them in order to merge this Pull Request. You can execute the snippet below to reset your branch and resolve the conflict manually.

Make sure you replace origin by the name of the vitessio/vitess remote

git fetch --all
gh pr checkout 20797
git reset --hard origin/release-23.0
git cherry-pick -m 1 76ebfa4096192d575f3bbfdd2ae491b96dc5f9a6

Copilot

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Adds GitHub Actions automation for PR hygiene tasks, performance-benchmark commenting, and syncing generated error-code docs to the website repo, plus a small Codecov flags fix and a new composite action to set up Percona’s APT repo.

Changes:

Add pull_request_target workflows to comment/label PRs on open and to comment when “Benchmark me” label is applied
Add a workflow_run pipeline that updates the website repo’s error-code documentation from generated artifacts
Adjust Codecov “partial” flag expression and introduce a composite action to cache/install Percona repo package

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 13 comments.

Show a summary per file

File	Description
.github/workflows/pr_opened_tasks.yml	New PR-open automation to add checklist comment and initial labels, with label-based skips
.github/workflows/error_code_docs_update.yml	New workflow that pulls generated docs artifacts and opens/updates a PR in the website repo
.github/workflows/codecov.yml	Tweaks expression used to set Codecov upload flags
.github/workflows/arewefastyet_comment.yml	New workflow that comments when “Benchmark me” is applied
.github/actions/setup-percona-repo/action.yml	New composite action to cache/download/install Percona repo package

Suppressed comments (2)

.github/workflows/error_code_docs_update.yml:1

Passing the entire generated doc block through awk -v codes=... can be fragile for large artifacts and for content that includes characters/newlines that interact poorly with shell argument passing. Prefer having awk read from the file directly (or use a safer file-insertion approach) so the workflow doesn’t risk hitting command-size limits or mangling content.

# Updates the website repository with generated error code documentation.

.github/actions/setup-percona-repo/action.yml:1

The download step doesn’t fail on HTTP errors and doesn’t validate what was downloaded (curl -sL ...). This can lead to installing a truncated/HTML error response via dpkg -i. Use curl -f (and ideally --retry/--retry-connrefused) and consider validating the package (checksum/signature) before installing. Also, lsb_release is used before lsb-release is installed; install it first or avoid the dependency if the runner image changes.

name: 'Setup Percona Apt Repo'

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+      - name: Generate GitHub App token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        id: app-token
+        with:
+          app-id: ${{ vars.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-pull-requests: read


+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          # Get labels for this pull request
+          LABELS=$(gh api repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels --jq '.[].name')


+      - name: Generate GitHub App token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        id: app-token
+        with:
+          app-id: ${{ vars.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-pull-requests: write


+          gh pr edit ${{ github.event.pull_request.number }} \
+            --repo ${{ github.repository }} \
+            --add-label "NeedsWebsiteDocsUpdate,NeedsDescriptionUpdate,NeedsIssue,NeedsBackportReason"


+    name: Add arewefastyet comment
+    permissions:
+      pull-requests: write


+      - name: Update error documentation
+        if: steps.metadata.outputs.skip != 'true' && steps.docs_version.outputs.skip != 'true'
+        id: update_docs
+        env:
+          VERSION: ${{ steps.docs_version.outputs.version }}
+        run: |
+          DOC_PATH="/tmp/website/content/en/docs/${VERSION}/reference/errors/query-serving.md"


+            !skip { print }
+          ' "$DOC_PATH" > /tmp/query-serving-new.md
+
+          mv /tmp/query-serving-new.md "$DOC_PATH"


+      - name: Create or update PR on website
+        if: steps.metadata.outputs.skip != 'true' && steps.docs_version.outputs.skip != 'true' && steps.update_docs.outputs.skip != 'true'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}


+          # Check if branch already exists.
+          if gh api "repos/${REPO_OWNER}/website/branches/${BRANCH_NAME}" --silent 2>/dev/null; then
+            echo "Branch ${BRANCH_NAME} already exists, updating..."
+            git fetch origin "${BRANCH_NAME}"
+            git checkout "${BRANCH_NAME}"
+            git reset --hard origin/prod
+          else
+            echo "Creating new branch ${BRANCH_NAME}..."
+            git checkout -b "${BRANCH_NAME}"
+          fi
+
+          # Stage and commit changes.
+          git add "$DOC_PATH"
+          git commit -m "Updated the query-serving error code"


        fail_ci_if_error: true
        verbose: true
-        flags: ${{ steps.mode.outputs.is_full_run == 'true' && '' || 'partial' }}
+        flags: ${{ steps.mode.outputs.is_full_run != 'true' && 'partial' || '' }}


Only codecov.yml exists on this branch, so the codecov flags fix is all that carries over. Drop the hunks for setup-percona-repo, the arewefastyet comment workflow, the error code docs update workflow and the PR opened tasks workflow: none of them exist here, so the cherry-pick left the versions from main in the tree and would have introduced them. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Arthur Schreiber <arthur@planetscale.com>

arthurschreiber · 2026-08-04T18:13:01Z

Resolved the conflicts.

Of the five paths #20786 touches, only codecov.yml exists on release-23.0 — setup-percona-repo, arewefastyet_comment.yml, error_code_docs_update.yml and pr_opened_tasks.yml are all absent here. The cherry-pick left main's versions in the tree for those and the bot committed them, so as created this PR would have introduced four files this branch never had. I dropped them.

That leaves the codecov flags fix, which is worth having on its own: is_full_run == 'true' && '' || 'partial' always evaluated to 'partial', because the true-arm '' is falsy and the || fell through. Inverting the condition makes the ternary sound, so scheduled full runs upload unflagged as intended.

No conflict markers remain and no Go files change.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

chatgpt-codex-connector · 2026-08-05T11:37:35Z

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

Cherry-pick 76ebfa4 with conflicts

37be4cd

Copilot AI balanced review requested due to automatic review settings August 4, 2026 18:06

vitess-bot Bot added Component: Build/CI Backport This is a backport Skip CI Skip CI actions from running Merge Conflict Type: Security labels Aug 4, 2026

vitess-bot Bot requested review from arthurschreiber, frouioui and rohit-nayak-ps August 4, 2026 18:06

arthurschreiber self-assigned this Aug 4, 2026

Copilot AI reviewed Aug 4, 2026

View reviewed changes

github-actions Bot added this to the v23.0.6 milestone Aug 4, 2026

arthurschreiber removed Skip CI Skip CI actions from running Merge Conflict labels Aug 4, 2026

Copilot AI review requested due to automatic review settings August 4, 2026 18:12

Copilot started reviewing on behalf of arthurschreiber August 4, 2026 18:12 View session

Copilot AI reviewed Aug 4, 2026

View reviewed changes

arthurschreiber marked this pull request as ready for review August 5, 2026 11:37

arthurschreiber requested a review from mattlord as a code owner August 5, 2026 11:37

arthurschreiber enabled auto-merge (squash) August 5, 2026 11:37

mhamza15 approved these changes Aug 5, 2026

View reviewed changes

timvaillancourt approved these changes Aug 5, 2026

View reviewed changes

arthurschreiber merged commit 23d9932 into release-23.0 Aug 5, 2026
108 checks passed

arthurschreiber deleted the backport-20786-to-release-23.0 branch August 5, 2026 12:32

Navigation Menu

Uh oh!

[release-23.0] CI: scope app tokens to steps instead of exporting via GITHUB_ENV (#20786) - #20797

[release-23.0] CI: scope app tokens to steps instead of exporting via GITHUB_ENV (#20786)#20797
arthurschreiber merged 2 commits into
release-23.0from
backport-20786-to-release-23.0

vitess-bot Bot commented Aug 4, 2026

Uh oh!

vitess-bot Bot commented Aug 4, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

arthurschreiber commented Aug 4, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

chatgpt-codex-connector Bot commented Aug 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

vitess-bot Bot commented Aug 4, 2026

Description

Uh oh!

vitess-bot Bot commented Aug 4, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

arthurschreiber commented Aug 4, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

chatgpt-codex-connector Bot commented Aug 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants