From b8303070140740b1b3298484f8656904f49370cb Mon Sep 17 00:00:00 2001 From: Tsvika Shapira Date: Sun, 27 Sep 2026 14:32:29 +0300 Subject: [PATCH] fix(ci): run tests on PRs opened by the update workflows The scheduled template-pins run failed with "GitHub Actions is not permitted to create or approve pull requests": that repo setting was off. It is now on, and both PR-creating workflows (template pins, and the generated deps-update) say so in a header comment. A PR opened with GITHUB_TOKEN triggers no pull_request workflows, so each now dispatches its test workflow on the PR branch; workflow_dispatch is exempt from that rule. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01GyMoD8tx4oz1bpJ1tEL845 --- .github/workflows/update-template-pins.yml | 12 ++++++++++++ project_name/.github/workflows/deps-update.yml | 11 +++++++++++ 2 files changed, 23 insertions(+) diff --git a/.github/workflows/update-template-pins.yml b/.github/workflows/update-template-pins.yml index 6ab6ac8..eb1a37a 100644 --- a/.github/workflows/update-template-pins.yml +++ b/.github/workflows/update-template-pins.yml @@ -1,3 +1,5 @@ +# Needs "Allow GitHub Actions to create and approve pull requests" enabled in +# Settings > Actions > General, or creating the pull request fails. name: Update template action pins # Dependabot cannot see the pins under project_name/, @@ -21,6 +23,7 @@ jobs: permissions: contents: write pull-requests: write + actions: write # to dispatch the tests steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: @@ -50,6 +53,7 @@ jobs: done - name: Create pull request + id: cpr uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: token: ${{ secrets.GITHUB_TOKEN }} @@ -65,3 +69,11 @@ jobs: branch: ci/template-action-pins delete-branch: true labels: dependencies + + - name: Run tests on the pull request + # Pull requests opened with GITHUB_TOKEN trigger no `pull_request` workflows, + # but `workflow_dispatch` is exempt, and its checks show on the PR head. + if: steps.cpr.outputs.pull-request-operation == 'created' || steps.cpr.outputs.pull-request-operation == 'updated' + env: + GH_TOKEN: ${{ github.token }} + run: gh workflow run uv-tests.yml --repo "$GITHUB_REPOSITORY" --ref ci/template-action-pins diff --git a/project_name/.github/workflows/deps-update.yml b/project_name/.github/workflows/deps-update.yml index 8d06cad..228e953 100644 --- a/project_name/.github/workflows/deps-update.yml +++ b/project_name/.github/workflows/deps-update.yml @@ -1,3 +1,5 @@ +# Needs "Allow GitHub Actions to create and approve pull requests" enabled in +# Settings > Actions > General, or creating the pull request fails. name: Update Dependencies on: @@ -11,6 +13,7 @@ jobs: permissions: contents: write pull-requests: write + actions: write # to dispatch the tests steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -36,6 +39,7 @@ jobs: uv run just deps-list-outdated 2>&1 || true echo 'EOF' >> "$GITHUB_OUTPUT" - name: Create Pull Request + id: cpr uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: token: ${{ secrets.GITHUB_TOKEN }} @@ -56,3 +60,10 @@ jobs: branch: deps/update delete-branch: true labels: dependencies + - name: Run tests on the pull request + # Pull requests opened with GITHUB_TOKEN trigger no `pull_request` workflows, + # but `workflow_dispatch` is exempt, and its checks show on the PR head. + if: steps.cpr.outputs.pull-request-operation == 'created' || steps.cpr.outputs.pull-request-operation == 'updated' + env: + GH_TOKEN: ${{ github.token }} + run: gh workflow run ci.yml --repo "$GITHUB_REPOSITORY" --ref deps/update