ci: point the dispatch at the dedicated Postman app - #40
Conversation
Swaps CB_SDK_BOT_APP_ID / CB_SDK_BOT_PEM_KEY for the dedicated app's POSTMAN_DISPATCH_APP_ID / POSTMAN_DISPATCH_PEM_KEY. The app is installed on chargebee/cb-openapi-generator alone with Contents: write, per the #ask-cloud guidance to use an app rather than a rotating personal access token.
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d0e2981565
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
3 participants
What
Swaps the two secret names in
notify-postman.ymlfromCB_SDK_BOT_APP_ID/CB_SDK_BOT_PEM_KEYto the dedicated app'sPOSTMAN_DISPATCH_APP_ID/POSTMAN_DISPATCH_PEM_KEY. Six lines, no logic change.Why
Per @Krishna's guidance in #ask-cloud: this is a recurring automation rather than a one-off, so it should authenticate as a GitHub App instead of a personal access token, since token rotation would become a maintenance burden. A dedicated app was provisioned for it, installed on
chargebee/cb-openapi-generatoralone with Contents: write — the single permissionrepository_dispatchrequires. It holds no access to this repository.The PAT alternative was abandoned; that request and its revert PR (#39) are both closed.
Verified working
Ran the workflow against this branch before opening, so the credentials are proven rather than assumed:
https://github.com/chargebee/openapi/actions/runs/33764425769
That confirms the app id and key are valid, the app is installed on the target repo, and the permission is sufficient — HTTP 204 is the only path that prints that line. The token is revoked at job end, so nothing outlives the run.
Note on the receiving end
The consumer,
postman-regenerate.yml, is still on an unmerged branch in cb-openapi-generator (chargebee/cb-openapi-generator#327).repository_dispatchonly starts workflows present on the default branch, so until that PR lands the event is accepted and discarded. Harmless, and the same PR carries the hourly poll as a backstop, but end-to-end only closes once it merges.Unchanged
Fail-soft behaviour.
continue-on-erroron the token step plus the empty-token check mean a missing or malformed key logs a notice and exits 0 rather than reporting a spec release as broken.