diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml index 426f0b0..817e860 100644 --- a/.github/workflows/verify.yml +++ b/.github/workflows/verify.yml @@ -31,7 +31,7 @@ jobs: - run: go test ./... - run: go build ./... - auto-merge-sync: + verify-sync-provenance: if: >- github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && @@ -39,22 +39,11 @@ jobs: needs: test runs-on: ubuntu-latest steps: - - name: Create publisher token - id: app-token - uses: actions/create-github-app-token@v3 - with: - client-id: ${{ vars.OPERATOR_STACK_PUBLISHER_APP_CLIENT_ID || vars.BOATSTACK_APP_CLIENT_ID }} - private-key: ${{ secrets.OPERATOR_STACK_PUBLISHER_APP_PRIVATE_KEY || secrets.BOATSTACK_APP_PRIVATE_KEY }} - owner: operatorstack - repositories: interlock - permission-contents: write - permission-pull-requests: write - uses: actions/checkout@v4 with: ref: ${{ github.event.pull_request.head.sha }} - name: Verify generated projection provenance env: - APP_SLUG: ${{ steps.app-token.outputs.app-slug }} HEAD_BRANCH: ${{ github.head_ref }} PR_AUTHOR: ${{ github.event.pull_request.user.login }} shell: bash @@ -62,11 +51,6 @@ jobs: source_repo="$(jq -r '.source.repository' UPSTREAM.json)" source_commit="$(jq -r '.source.commit' UPSTREAM.json)" short="${source_commit:0:12}" - [[ "$PR_AUTHOR" == "${APP_SLUG}[bot]" ]] + [[ "$PR_AUTHOR" == "operator-stack-publisher[bot]" ]] [[ "$source_repo" == "operatorstack/intelligence-flow" ]] [[ "$HEAD_BRANCH" == "sync/intelligence-flow-$short" ]] - - name: Merge verified sync PR - env: - GH_TOKEN: ${{ steps.app-token.outputs.token }} - PR_URL: ${{ github.event.pull_request.html_url }} - run: gh pr merge "$PR_URL" --squash