Use GitHub App token in nightly package build#412
Merged
Conversation
The shared org PAT (secrets.GH_TOKEN) was retired after the packaging repo migrated to a GitHub App token, breaking the nightly: the citus/packaging container resolves the citus commit ref via an authenticated GitHub API call that fail-closes on 401. Mint a GitHub App token with actions/create-github-app-token@v3 and export both GH_TOKEN and GITHUB_TOKEN to the environment (the container's ~/.curlrc consumes GITHUB_TOKEN). Mirrors the proven pattern already green in citus-package-all-platforms-test.yml and packaging PR #1189. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The scheduled Build and publish citus community nightly packages workflow (
build-citus-community-nightlies.yml) started failing on all 7 platform matrix jobs at the "Build packages" step (e.g. run 28634135942) withcould not determine commit for git ref main.Root cause: this nightly is the lone unmigrated straggler still consuming the shared org PAT
secrets.GH_TOKEN. When citusdata/packaging migrated to a GitHub App token (#1189), the shared org PAT was subsequently retired externally (after 2026-07-02). Inside thecitus/packagingcontainer,fetch_and_build_rpm/_debresolve the citus commit SHA via an authenticated GitHub API call (~/.curlrcinjectsAuthorization: token ${GITHUB_TOKEN});curl -sffail-closes on the resulting 401, hiding the error → fast failure across all 7 jobs. Timeline: succeeded 07-02 02:21Z (PAT alive) → fails from 07-03 02:19Z (PAT dead).Fix
Mirror the packaging #1189 nightly pattern (and the proven-green in-repo precedent
citus-package-all-platforms-test.yml):GH_TOKEN: ${{ secrets.GH_TOKEN }}shadow from the top-levelenv:block.GH_TOKENandGITHUB_TOKENto$GITHUB_ENV.Exporting
GITHUB_TOKEN(not justGH_TOKEN) is essential: the failing call is the in-container~/.curlrcpath that consumesGITHUB_TOKEN. The existing--gh_token "${GH_TOKEN}"invocation is left untouched — it now resolves to the freshly minted App token.Net +13 / −1, single file. Creds confirmed available to
citusdata/tools(5 sibling workflows already mintcreate-github-app-token@v3withvars.GH_APP_ID/secrets.GH_APP_KEY/owner: citusdataand run green ondevelop).Validation
Pushing this branch auto-fires the nightly (
push: "**"); publish gates onMAIN_BRANCH="all-citus"≠ this branch, so publish stays OFF — a build-only validation run.Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com