Grant PR board-sync callers GITHUB_TOKEN write - #1132
Merged
Conversation
Repo-scoped writes in shader-slang/slang's reusable workflow now use github-actions[bot] via GITHUB_TOKEN, so slangpy callers must pass those permissions through rather than inheriting an empty grant.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Team Run ID: 📒 Files selected for processing (5)
Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review. 📝 WalkthroughWalkthroughThe PR adds job-level ChangesBoard-sync repository permissions
Merge Risk: ⚪ Minimal · up to This change grants limited repository write permissions to board-sync jobs while leaving the fork-review bridge without write access; no actionable merge-blocking risk remains beyond normal checks and review. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (5 skipped: 5 unsupported.) Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
5 tasks
jkiviluoto-nv
approved these changes
Sep 3, 2026
jhelferty-nv
enabled auto-merge (squash)
September 3, 2026 16:12
jhelferty-nv
deleted the
chore/pr-board-sync-github-token-permissions
branch
September 3, 2026 16:28
pdeayton-nv
pushed a commit
to pdeayton-nv/slang
that referenced
this pull request
Sep 3, 2026
## Motivation PR board sync used `SLANG_PR_BOT_TOKEN` for repo writes: assignment comments, assignees, and review requests. That token is a fine-grained PAT owned by a human. GitHub auto-subscribes whoever comments on a thread, so the PAT owner became a watcher of every PR the workflow greeted. There is no comment-API flag to skip that subscription. ## Proposed solution Keep the PAT for what `GITHUB_TOKEN` cannot do: org team reads (Source classification) and org ProjectsV2 writes (the shared board). Route every repo-scoped write through the run's `GITHUB_TOKEN` so the visible actor is `github-actions[bot]`: - PR and linked-issue assignees - Community-author co-assignment - Reviewer requests and ignored-reviewer removals - The assignment comment Callers grant `issues: write` and `pull-requests: write` on the calling job. The reusable workflow declares no `permissions:` block of its own: requesting more than the caller granted would fail the run at startup for every un-updated cross-repo caller. Assignment and reviewer writes fall back to the PAT on a 403 so existing callers keep working during rollout. Comments never fall back: posting as the PAT would subscribe its owner again. Companion caller update: [shader-slang/slangpy#1132](shader-slang/slangpy#1132). ## Change summary | Area | Change | | --- | --- | | `pr-board-sync.yml` | `actionsWrite` posts repo writes with `GITHUB_TOKEN`; PAT fallback for assignees/reviewers only | | Caller workflows in this repo | Job-level `issues: write` + `pull-requests: write` | | `pr-board-sync-templates/` | Same grants and docs for cross-repo copy-me callers | | `pr-write-identity.test.js` | Covers `GITHUB_TOKEN` routing, PAT fallback, and no-fallback comments | | `pr-board-sync.md` | Documents the identity split and caller permission contract | ## Concepts and vocabulary - **`GITHUB_TOKEN`**: per-run Actions token; comments and assigns as `github-actions[bot]`. - **`SLANG_PR_BOT_TOKEN`**: org-level fine-grained PAT used for org teams and ProjectsV2, and as a rollout fallback for assignment/reviewer writes. - **Caller ceiling**: a reusable workflow's `GITHUB_TOKEN` cannot have more permission than the calling job granted. ## Process report Consider a Community PR with no owner yet. Board sync needs to assign someone, optionally request reviewers, comment that it did so, classify Source from org team membership, and set Status on the shared ProjectsV2 board. The last two of those are org-scoped. `GITHUB_TOKEN` has no Members or org Projects access, so they stay on the PAT. Switching them would break Source classification and the board. The first three are repo-scoped REST writes. They used the same PAT Octokit as the org calls, which is why the comment subscribed a human. `actions/github-script` is still bound to the PAT for those org calls, so repo writes go through a raw `fetch` with `github.token` instead of that Octokit. The reusable workflow does not declare write permissions itself. GitHub would reject un-updated callers at startup (`requesting pull-requests: write, but is only allowed none`). Inheritance plus PAT fallback for assignees/reviewers keeps board sync alive; comments are skipped until the caller grants `issues: write`. That input shape is intentional: a caller that has not granted write yet is a valid rollout state, not a malformed request. ## Test plan - [ ] `node .github/scripts/pr-write-identity.test.js` (and the existing assign/signal/classify tests) - [ ] On merge, open or wait for an unassigned Community PR and confirm the assignment comment is from `github-actions[bot]`, not the PAT owner - [ ] Confirm the PAT owner is not newly subscribed to that PR - [ ] Confirm assignee and requested reviewer still land - [ ] Confirm the ProjectsV2 card still gets Source/Status
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
issues: writeandpull-requests: writeon the slangpy jobs that callshader-slang/slang/.github/workflows/pr-board-sync.yml.github-actions[bot]viaGITHUB_TOKENinstead ofSLANG_PR_BOT_TOKEN.pr-review-fork-bridge.ymlatpermissions: {}; it only relays fork-PR reviews and does not write to the repo or board.Org-team reads and ProjectsV2 writes still use the PAT. This is safe to merge before shader-slang/slang#12888: current slang
masterstill setspermissions: {}on the reusable workflow and authenticates every call with the PAT, so these grants are inert until that PR lands.Test plan
master, run a slangpy PR through board-sync and confirm assignment comments / assignee changes appear asgithub-actions[bot], not the PAT owner