From a20c35f7713fadb1d984b1472015dda5613c840b Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 11 Sep 2026 01:40:21 +0000 Subject: [PATCH] queue filing: open the PR with a QUEUE_PR_TOKEN secret when the repo setting is out of reach GITHUB_TOKEN may open a PR only under a repo setting the organisation can enforce and hide. A fine-grained PAT in a repo secret needs no setting, and a PR it opens also runs validate.yml, which a token-created PR never does. Falls back to the job token when the secret is absent. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Rhn9qWAjP54dP27dyEibG2 --- .github/workflows/queue_filing.yml | 29 +++++++++++++++++++---------- README.md | 6 ++++-- 2 files changed, 23 insertions(+), 12 deletions(-) diff --git a/.github/workflows/queue_filing.yml b/.github/workflows/queue_filing.yml index 9076a0b..e481745 100644 --- a/.github/workflows/queue_filing.yml +++ b/.github/workflows/queue_filing.yml @@ -23,14 +23,19 @@ name: Queue filing # workflows (validate.yml) do NOT run on it — `make validate` + pytest run # here as the gate instead, before anything is pushed. # -# **The PR needs one repo setting.** GITHUB_TOKEN may open a PR only when -# "Allow GitHub Actions to create and approve pull requests" is on -# (Settings → Actions → General → Workflow permissions). Off, the filing -# still lands on its `queue-filing/issue-` branch, gated, and the issue -# gets a one-tap compare link instead of a PR — but nothing reaches `main` -# until a human opens and merges it, and the board's *Filings awaiting -# merge* section is where those branches wait. Three did, unnoticed, between -# 2026-09-01 and 2026-09-10; the setting is the fix. +# **Opening the PR needs a token that is allowed to.** GITHUB_TOKEN may open +# a PR only when "Allow GitHub Actions to create and approve pull requests" +# is on (Settings → Actions → General → Workflow permissions — and when the +# organisation enforces that setting the repo page does not even show it). +# So the PR step prefers a `QUEUE_PR_TOKEN` repo secret when one exists: a +# fine-grained personal access token scoped to this repo with *Pull +# requests: read and write* (plus the metadata read it gets by default). +# A PR opened with it also runs validate.yml, which a GITHUB_TOKEN-created +# PR never does. Without either, the filing still lands on its +# `queue-filing/issue-` branch, gated, and the issue gets a one-tap +# compare link instead of a PR — but nothing reaches `main` until a human +# opens and merges it, and the board's *Filings awaiting merge* section is +# where those branches wait. Six did between 2026-09-01 and 2026-09-11. # # A second tap on the same paper does not file it twice: a filing branch # that already exists for this issue, or for another open issue naming the @@ -302,6 +307,10 @@ jobs: - name: Branch, commit, push, open the PR (explicit paths only) if: steps.resolve.outputs.skip != 'yes' && steps.dup.outputs.skip != 'yes' + env: + # Empty when the secret is not set; the PR step then falls back to + # the job token and the repo setting decides (header above). + PR_TOKEN: ${{ secrets.QUEUE_PR_TOKEN }} run: | git config user.name "github-actions[bot]" git config user.email "github-actions[bot]@users.noreply.github.com" @@ -325,7 +334,7 @@ jobs: echo echo "Closes #${ISSUE}." } > /tmp/pr_body.md - if gh pr create --base main --head "$branch" \ + if GH_TOKEN="${PR_TOKEN:-$GH_TOKEN}" gh pr create --base main --head "$branch" \ --title "queue filing: paper from #${ISSUE}" \ --body-file /tmp/pr_body.md; then gh issue comment "$ISSUE" --body \ @@ -336,7 +345,7 @@ jobs: # The board lists the branch under "Filings awaiting merge" until # it lands or is deleted. gh issue comment "$ISSUE" --body \ - "Filing branch pushed and gated: \`${branch}\` — but this repo's policy blocks Actions from opening PRs. Open it with one tap: ${GITHUB_SERVER_URL}/${GH_REPO}/compare/main...${branch}?expand=1 — or enable 'Allow GitHub Actions to create and approve pull requests' (Settings → Actions → General) to make this automatic. Until it is merged, the paper is on that branch and not in memory; the dashboard lists it under *Filings awaiting merge*." + "Filing branch pushed and gated: \`${branch}\` — but this repo's policy blocks Actions from opening PRs. Open it with one tap: ${GITHUB_SERVER_URL}/${GH_REPO}/compare/main...${branch}?expand=1 — or make this automatic by adding a \`QUEUE_PR_TOKEN\` repo secret (a fine-grained PAT with pull-requests write on this repo; see queue_filing.yml's header). Until it is merged, the paper is on that branch and not in memory; the dashboard lists it under *Filings awaiting merge*." fi - name: Report failure on the issue diff --git a/README.md b/README.md index 1f83855..cc6dd78 100644 --- a/README.md +++ b/README.md @@ -29,8 +29,10 @@ The per-paper buttons file GitHub issues that two workflows act on: `queue_actions.yml` makes the mechanical moves (➕ ✅ ✖️ 🧹) and closes the issue; `queue_filing.yml` has Claude file a 📥/📑 paper onto a `queue-filing/issue-` branch, gated, for a human to merge — and it opens -that PR itself only once *Allow GitHub Actions to create and approve pull -requests* is on (Settings → Actions → General). A tap whose label the issue +that PR itself when a `QUEUE_PR_TOKEN` repo secret (a fine-grained PAT with +pull-requests write on this repo) exists, or when *Allow GitHub Actions to +create and approve pull requests* is on (Settings → Actions → General). A tap +whose label the issue form dropped is read from its title; whatever nothing acted on is re-dispatched by the nightly `queue_sweep.yml`; and a filing that reached its branch but not `main` sits at the top of the board under **Filings awaiting