Skip to content

ci(oc): Refactor workflows to use GitHub app #1626

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
EttyKitty merged 7 commits into from
Oct 7, 2026
Merged

ci(oc): Refactor workflows to use GitHub app #1626

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
a39ac5b
Refactor GitHub Actions to use app tokens for permissions
EttyKitty Oct 7, 2026
cc9afb1
Replace app-id with client-id in token minting
EttyKitty Oct 7, 2026
7299928
Review points
EttyKitty Oct 7, 2026
9d7d0b8
Use generated token for issue triage actions
EttyKitty Oct 7, 2026
e98eb03
Use app tokens for opencode review
EttyKitty Oct 7, 2026
33cb07b
Update reviewer login format in workflow file
EttyKitty Oct 7, 2026
93de381
Modify bot user configuration in workflow
EttyKitty Oct 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
52 changes: 42 additions & 10 deletions .github/workflows/opencode.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,10 +26,18 @@ jobs:
authorized: ${{ steps.check.outputs.authorized }}

steps:
- name: Mint Token
id: auth-token
uses: actions/create-github-app-token@v3.2.0
with:
client-id: ${{ vars.LYRA_CLIENT_ID }}
private-key: ${{ secrets.LYRA_PRIVATE_KEY }}
permission-administration: read

- name: Check Write Permission
id: check
env:
GH_TOKEN: ${{ secrets.PAT_ADMIN_READ }}
GH_TOKEN: ${{ steps.auth-token.outputs.token }}
ACTOR: ${{ github.actor }}
run: |
if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
Expand Down Expand Up @@ -57,10 +65,20 @@ jobs:
timeout-minutes: 30

steps:
- name: Mint Issues Token
id: issues-token
uses: actions/create-github-app-token@v3.2.0
with:
client-id: ${{ vars.LYRA_CLIENT_ID }}
private-key: ${{ secrets.LYRA_PRIVATE_KEY }}
permission-issues: write
permission-pull-requests: write
permission-contents: read

- name: Acknowledge Command
if: github.event_name != 'workflow_dispatch'
env:
GH_TOKEN: ${{ secrets.LYRA_CONTENTS_PRS_ISSUES_PAT }}
GH_TOKEN: ${{ steps.issues-token.outputs.token }}
COMMENT_ID: ${{ github.event.comment.id }}
EVENT_NAME: ${{ github.event_name }}
run: |
Expand All @@ -77,9 +95,10 @@ jobs:
- name: Prepare Workspace & Context
id: context
env:
GH_TOKEN: ${{ secrets.LYRA_CONTENTS_PRS_ISSUES_PAT }}
GH_TOKEN: ${{ steps.issues-token.outputs.token }}
EVENT_NAME: ${{ github.event_name }}
INPUT_PROMPT: ${{ inputs.prompt }}
SLUG: ${{ steps.issues-token.outputs.app-slug }}
run: |
IS_PR="false"
if jq -e '.issue.pull_request // .pull_request' "$GITHUB_EVENT_PATH" > /dev/null; then
Expand Down Expand Up @@ -133,8 +152,12 @@ jobs:
fi
echo "branch=$BRANCH_NAME" >> "$GITHUB_OUTPUT"

git config user.name "lyra-the-bot"
git config user.email "lyra-the-bot@users.noreply.github.com"
BOT_NAME="${SLUG}[bot]"
BOT_USER_ID=$(gh api "users/${BOT_NAME}" --jq .id)

git config user.name "$BOT_NAME"
git config user.email "${BOT_USER_ID}+${BOT_NAME}@users.noreply.github.com"

echo "base_sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

# Diff context for review comments
Expand Down Expand Up @@ -210,7 +233,7 @@ jobs:
- name: Empty Prompt Hint
if: steps.context.outputs.empty == 'true' && github.event_name != 'workflow_dispatch'
env:
GH_TOKEN: ${{ secrets.LYRA_CONTENTS_PRS_ISSUES_PAT }}
GH_TOKEN: ${{ steps.issues-token.outputs.token }}
TARGET_NUM: ${{ steps.context.outputs.num }}
run: |
if [ -n "$TARGET_NUM" ]; then
Expand Down Expand Up @@ -238,11 +261,20 @@ jobs:
run: |
opencode run -m "$OPENCODE_MAIN_MODEL" --variant xhigh < /tmp/prompt.txt > /tmp/opencode_output.txt

- name: Mint Contents Token
Comment thread
EttyKitty marked this conversation as resolved.
if: steps.context.outputs.empty != 'true' && steps.opencode.outcome == 'success'
id: contents-token
uses: actions/create-github-app-token@v3.2.0
with:
client-id: ${{ vars.LYRA_CLIENT_ID }}
private-key: ${{ secrets.LYRA_PRIVATE_KEY }}
permission-contents: write

- name: Sync Results & Respond
if: steps.context.outputs.empty != 'true' && steps.opencode.outcome == 'success'
env:
GH_TOKEN: ${{ secrets.LYRA_CONTENTS_PRS_ISSUES_PAT }}
PUSH_TOKEN: ${{ secrets.PAT_CONTENTS_WRITE }}
GH_TOKEN: ${{ steps.issues-token.outputs.token }}
PUSH_TOKEN: ${{ steps.contents-token.outputs.token }}
IS_PR: ${{ steps.context.outputs.is_pr }}
TARGET_NUM: ${{ steps.context.outputs.num }}
BRANCH_NAME: ${{ steps.context.outputs.branch }}
Expand Down Expand Up @@ -316,7 +348,7 @@ jobs:
- name: Report Failure
if: failure() && github.event_name != 'workflow_dispatch'
env:
GH_TOKEN: ${{ secrets.LYRA_CONTENTS_PRS_ISSUES_PAT }}
GH_TOKEN: ${{ steps.issues-token.outputs.token }}
run: |
NUM=$(jq -r '.issue.number // .pull_request.number // empty' "$GITHUB_EVENT_PATH")
if [ -n "$NUM" ]; then
Expand All @@ -326,7 +358,7 @@ jobs:
- name: Remove Eyes Reaction
if: always() && github.event_name != 'workflow_dispatch'
env:
GH_TOKEN: ${{ secrets.LYRA_CONTENTS_PRS_ISSUES_PAT }}
GH_TOKEN: ${{ steps.issues-token.outputs.token }}
COMMENT_ID: ${{ github.event.comment.id }}
EVENT_NAME: ${{ github.event_name }}
run: |
Expand Down
22 changes: 16 additions & 6 deletions .github/workflows/opencode_issue_triage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,11 +31,21 @@ jobs:
issues: read

steps:
- name: Mint Issues Token
id: issues-token
uses: actions/create-github-app-token@v3.2.0
with:
client-id: ${{ vars.LYRA_CLIENT_ID }}
private-key: ${{ secrets.LYRA_PRIVATE_KEY }}
permission-issues: write
permission-pull-requests: write
permission-contents: read

- name: Acknowledge Command
if: github.event_name == 'issue_comment'
env:
GITHUB_TOKEN: ${{ secrets.LYRA_PRS_ISSUES_PAT }}
GH_TOKEN: ${{ secrets.LYRA_PRS_ISSUES_PAT }}
GITHUB_TOKEN: ${{ steps.issues-token.outputs.token }}
GH_TOKEN: ${{ steps.issues-token.outputs.token }}
COMMENT_ID: ${{ github.event.comment.id }}
run: |
gh api repos/${{ github.repository }}/issues/comments/${COMMENT_ID}/reactions -f content='eyes'
Expand Down Expand Up @@ -132,8 +142,8 @@ jobs:
- name: Apply Triage Plan
env:
ISSUE_NUMBER: ${{ github.event.issue.number }}
GITHUB_TOKEN: ${{ secrets.LYRA_PRS_ISSUES_PAT }}
GH_TOKEN: ${{ secrets.LYRA_PRS_ISSUES_PAT }}
GITHUB_TOKEN: ${{ steps.issues-token.outputs.token }}
GH_TOKEN: ${{ steps.issues-token.outputs.token }}
run: |
if [ ! -f /tmp/triage_plan.json ]; then
echo "::error::Triage plan /tmp/triage_plan.json was not generated."
Expand Down Expand Up @@ -288,8 +298,8 @@ jobs:
- name: Post Investigation Comment
env:
ISSUE_NUMBER: ${{ github.event.issue.number }}
GITHUB_TOKEN: ${{ secrets.LYRA_PRS_ISSUES_PAT }}
GH_TOKEN: ${{ secrets.LYRA_PRS_ISSUES_PAT }}
GITHUB_TOKEN: ${{ steps.issues-token.outputs.token }}
GH_TOKEN: ${{ steps.issues-token.outputs.token }}
run: |
if [ -s /tmp/investigation.md ]; then
echo "Posting investigation findings to issue #${ISSUE_NUMBER}..."
Expand Down
24 changes: 17 additions & 7 deletions .github/workflows/opencode_review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
) || (
github.event_name == 'pull_request_target' &&
github.event.requested_reviewer.login == 'lyra-the-bot'
github.event.requested_reviewer.login == format('{0}[bot]', vars.LYRA_SLUG)
)

runs-on: ubuntu-latest
Expand All @@ -29,11 +29,21 @@ jobs:
pull-requests: write

steps:
- name: Mint Issues Token
id: issues-token
uses: actions/create-github-app-token@v3.2.0
with:
client-id: ${{ vars.LYRA_CLIENT_ID }}
private-key: ${{ secrets.LYRA_PRIVATE_KEY }}
permission-issues: write
permission-pull-requests: write
permission-contents: read

- name: Acknowledge Command
if: github.event_name == 'issue_comment'
env:
GITHUB_TOKEN: ${{ secrets.LYRA_PRS_ISSUES_PAT }}
GH_TOKEN: ${{ secrets.LYRA_PRS_ISSUES_PAT }}
GITHUB_TOKEN: ${{ steps.issues-token.outputs.token }}
GH_TOKEN: ${{ steps.issues-token.outputs.token }}
COMMENT_ID: ${{ github.event.comment.id }}
run: |
gh api repos/${{ github.repository }}/issues/comments/${COMMENT_ID}/reactions -f content='eyes'
Expand All @@ -56,12 +66,12 @@ jobs:
gh pr checkout ${{ steps.pr-number.outputs.number }}
echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
env:
GH_TOKEN: ${{ secrets.LYRA_PRS_ISSUES_PAT }}
GH_TOKEN: ${{ steps.issues-token.outputs.token }}

- name: Get PR details
id: pr-details
env:
GH_TOKEN: ${{ secrets.LYRA_PRS_ISSUES_PAT }}
GH_TOKEN: ${{ steps.issues-token.outputs.token }}
PR_NUM: ${{ steps.pr-number.outputs.number }}
run: |
# 1. Fetch PR details
Expand Down Expand Up @@ -126,8 +136,8 @@ jobs:
if: steps.pr-details.outputs.review_mode != 'NO_CHANGES'
env:
OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
GH_TOKEN: ${{ secrets.LYRA_PRS_ISSUES_PAT }}
GITHUB_TOKEN: ${{ secrets.LYRA_PRS_ISSUES_PAT }}
GH_TOKEN: ${{ steps.issues-token.outputs.token }}
GITHUB_TOKEN: ${{ steps.issues-token.outputs.token }}
OPENCODE_PERMISSION: '{ "external_directory": { "/home/runner/work/**": "allow", "/tmp/*": "allow" } }'
PR_TITLE: ${{ steps.pr-details.outputs.title }}
PR_SHA: ${{ steps.pr-git.outputs.sha }}
Expand Down
Loading