fix(ci): push nightly telemetry via scoped fleet-bot app token#6
Closed
IgnazioDS wants to merge 1 commit into
Closed
fix(ci): push nightly telemetry via scoped fleet-bot app token#6IgnazioDS wants to merge 1 commit into
IgnazioDS wants to merge 1 commit into
Conversation
The default GITHUB_TOKEN cannot push to the ruleset-protected default branch, so this job has failed every run for ~18 nights and the committed-history-derived uptime_pct_30d has decayed toward zero. Mint a short-lived token from a scoped GitHub App (fleet-bot) that sits on the 'main protection' ruleset bypass list, and push with that. Human PRs are still required for everyone else. Requires repo secrets: FLEET_BOT_APP_ID, FLEET_BOT_PRIVATE_KEY.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Owner
Author
|
Superseded by the autonomous telemetry-data-branch approach (no GitHub App secret needed). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The nightly job has failed every run for ~18 nights. Root cause is not the job logic — the scan/scoring/benchmark runs fine — it is the final
git pushtomain:The
main protectionruleset requires a PR (code-owner review + last-push approval), and the defaultGITHUB_TOKENcannot push to a ruleset-protected branch. Becauseuptime_pct_30dis derived from committed run history, no new dated records have landed since 2026-05-28, so the trailing-30d window has been decaying uptime toward zero.Fix
Mint a short-lived token from a scoped GitHub App (
fleet-bot) that is on the ruleset bypass list, and push the nightly telemetry diff with that token. Humans still need PRs — only this app can write the auto-generated telemetry. The "auditable git diff on main → Vercel redeploy" design is unchanged.Required before this goes green (account action)
Add two repo secrets (see fleet handoff for the one-time App setup):
FLEET_BOT_APP_IDFLEET_BOT_PRIVATE_KEY…and add the App to this repo's
main protectionruleset Bypass list. Once present,workflow_dispatchthis job to verify the push succeeds; uptime rebuilds over the following 30 days.Risk
Low — workflow-only change. No app/library code touched. Reversible by reverting this commit.