MIP-0086: skills-update: open the PR as marola-pr-bot when…

.github/workflows/skills-update.yml

@@ -1,7 +1,7 @@
 # skills-update: re-vendor every skill in the caller's skills.lock at its upstream's newest commit
 # at least `min-age` days old, and keep one PR open on `branch` with the diffs as its body
 # (MIP-0080; docs/4-reference_workflows.md#skills-update). Nothing merges on its own.
-# A PR opened with the default GITHUB_TOKEN starts no CI; pass a PAT or App token as `token`.
+# A PR opened with the default GITHUB_TOKEN starts no CI; pass `pr_bot_key` (marola-pr-bot) or a PAT as `token`.
 name: skills-update
 
 on:
@@ -25,8 +25,11 @@ on:
         type: string
         default: chore/skills-update
     secrets:
+      pr_bot_key:
+        description: "marola-pr-bot's private key; mints the token that pushes and opens the PR, so the PR starts CI"
+        required: false
       token:
-        description: "pushes the branch and opens the PR; the default GITHUB_TOKEN otherwise"
+        description: "pushes the branch and opens the PR when pr_bot_key is absent; the default GITHUB_TOKEN otherwise"
         required: false
 
 permissions:
@@ -41,11 +44,35 @@ jobs:
       group: skills-update-${{ inputs.branch }}
       cancel-in-progress: true
     env:
-      GH_TOKEN: ${{ secrets.token || github.token }}
+      HAS_PR_BOT_KEY: ${{ secrets.pr_bot_key != '' }}
     steps:
+      # github.repository, not github.event.repository.name: that is empty on `schedule` events, and
+      # an empty `repositories` mints for every repo the App is installed on.
+      - name: repository name
+        id: repo
+        if: env.HAS_PR_BOT_KEY == 'true'
+        env:
+          REPO: ${{ github.repository }}
+        run: |
+          name="${REPO#*/}"
+          [ -n "$name" ] || { echo "::error::empty repository name"; exit 1; }
+          echo "name=$name" >>"$GITHUB_OUTPUT"
+
+      - name: marola-pr-bot token
+        id: app
+        if: env.HAS_PR_BOT_KEY == 'true'
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ vars.PR_BOT_APP_ID }}
+          private-key: ${{ secrets.pr_bot_key }}
+          owner: ${{ github.repository_owner }}
+          repositories: ${{ steps.repo.outputs.name }}
+          permission-contents: write
+          permission-pull-requests: write
+
       - uses: actions/checkout@v7
         with:
-          token: ${{ secrets.token || github.token }}
+          token: ${{ steps.app.outputs.token || secrets.token || github.token }}
 
       - uses: actions/checkout@v7
         with:
@@ -55,6 +82,7 @@ jobs:
 
       - name: skills-vendor update --all, then push the branch and open or refresh the PR
         env:
+          GH_TOKEN: ${{ steps.app.outputs.token || secrets.token || github.token }}
           BRANCH: ${{ inputs.branch }}
           LOCK: ${{ inputs.lock }}
           MIN_AGE: ${{ inputs.min-age }}

.github/workflows/skills.yml

@@ -17,3 +17,5 @@ jobs:
     with:
       devkit-ref: ${{ github.sha }}
       lock: plugins/marola-devkit/skills/skills.lock
+    secrets:
+      pr_bot_key: ${{ secrets.PR_BOT_KEY }}

CHANGELOG.md

@@ -4,6 +4,11 @@ Each release moves `plugin.json`'s `version`, the flake package version and ever
 together. A consumer adopts one by bumping its flake input, its workflow `@v…`/`devkit-ref` and its
 marketplace `ref` at once.
 
+## v0.10.1 — 2026-10-14
+
+- `skills-update` takes an optional secret `pr_bot_key` and opens its PR as `marola-pr-bot`; callers
+  pass `pr_bot_key: ${{ secrets.PR_BOT_KEY }}` so the PR starts CI (`ci-rule` needs `ci-ok`) (#116).
+
 ## v0.10.0 — 2026-10-14
 
 - `ruleset-sync` manages every manifest in `.github/rulesets/`, matched by name, and adds

docs/4-reference_workflows.md

@@ -402,6 +402,8 @@ jobs:
     uses: marola-dev/marola-devkit/.github/workflows/[email protected]
     with:
       devkit-ref: v0.10.0
+    secrets:
+      pr_bot_key: ${{ secrets.PR_BOT_KEY }}
 ```
 
 | Input | Default | Notes |
@@ -411,8 +413,10 @@ jobs:
 | `min-age` | `14` | days an upstream commit must have been public before it is vendored |
 | `branch` | `chore/skills-update` | force-pushed on every run that finds a change |
 
-Secret `token`, optional: a PR opened with the default `GITHUB_TOKEN` starts no CI; one opened
-with a PAT or App token does.
+Secret `pr_bot_key`, optional: `marola-pr-bot`'s private key (`vars.PR_BOT_APP_ID` is its id). The
+workflow mints a token for the caller's repo and pushes and opens the PR with it, so the PR starts
+CI; a PR opened with the default `GITHUB_TOKEN` starts none. Secret `token`, optional: a PAT used
+when `pr_bot_key` is absent. With neither, the job behaves as before.
 
 ## bot-token (composite action)