Support custom token for triggering CI on version PRs#12
Merged
Conversation
Replace the non-working API commit reroute with a token-aware push that temporarily swaps the remote URL to use a custom PAT/App token. Add interactive `bumpy ci setup` command that walks users through creating a fine-grained PAT or GitHub App and storing the secret. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Keep PR comments and other gh CLI operations using the default GH_TOKEN (GitHub Actions bot) so they aren't attributed to the PAT owner. Users can opt in by setting GH_TOKEN directly. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
actions/checkout sets http.extraheader with the default GITHUB_TOKEN, which takes precedence over URL-embedded credentials. Temporarily unset it during the push so BUMPY_GH_TOKEN is actually used, then restore it afterward. This avoids requiring persist-credentials: false. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
gh CLI auto-detects GITHUB_TOKEN in GitHub Actions, so explicitly setting GH_TOKEN is unnecessary. Users only need BUMPY_GH_TOKEN. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Detect bun/pnpm/yarn/npm and show the appropriate run command in workflow examples instead of hardcoding bunx. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remind users to enable branch protection on main so the PAT can only be used to push the version branch, not write directly. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Clarify that ci setup only supports GitHub-hosted repos. Only show the BUMPY_GH_TOKEN warning when running on GitHub Actions, since other CI providers don't have the same anti-recursion limitation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
The changes in this PR will be included in the next version bump.
|
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
BUMPY_GH_TOKENenv var — when set, bumpy pushes the version branch using the custom token, bypassing GitHub's anti-recursion guard so PR workflows fire automaticallybumpy ci setupinteractive command that walks users through creating a fine-grained PAT or GitHub App and stores it as a repo secret viagh secret setBUMPY_GH_TOKENis only used for the git push — PR comments and otherghCLI calls continue using the defaultGITHUB_TOKENso they appear as the Actions botactions/checkoutextraheader during push so the custom token is actually used (nopersist-credentials: falseneeded)Test plan
bumpy ci setuplocally, verify PAT flow works end-to-endBUMPY_GH_TOKENsecret, merge a changeset, verify version PR triggers CI checksBUMPY_GH_TOKENset — verify warning is logged🤖 Generated with Claude Code