Repository navigation
Go SDK migration: GitHub App for the release automation #2
Description
Follow-up to #1. Nothing to do yet: the App is needed only for the automation phase of NVIDIA/OpenShell#5031, after the history import and the standalone module are on main. Filed now so it isn't forgotten.
Why a separate App
The automation opens an update PR for each new core release tag, and the adaptation agent pushes fixes to it. Pushes and PRs made with GITHUB_TOKEN don't trigger workflows, so those PRs would get no CI or E2E checks. A personal access token belongs to one person, expires, and makes that person the last pusher, so they can't approve the PR under main-integrity. ai-openshell-infra[bot] carries org administration permissions, so a separate App keeps the scope narrow.
Request
| Setting | Value |
|---|---|
| Name | ai-openshell-sdk-bot |
| Owner | ai-openshell |
| Installed on | sdk-go only |
| Repository permissions | contents: write, pull_requests: write, issues: write, metadata: read |
| Webhook | none |
Please store the App ID and a private key as repository secrets on sdk-go: SDK_BOT_APP_ID and SDK_BOT_PRIVATE_KEY. Workflows mint short-lived tokens from them with actions/create-github-app-token.
The label-triggered adaptation workflow comes last and needs one more repository secret, ANTHROPIC_API_KEY.
Used by
core-watch.ymlopens the update PR for each new core tag.release-tag.ymltags the SDK release once an update PR merges.core-drift.ymlopens and updates the drift issue.adapt.ymlposts the task comment and pushes the agent's fixes.
Activity
rhuss commentedon Nov 4, 2026
@SDAChess this one is now due. The history import and the standalone module are on
main(#3, #4), and the automation is ready in #6. It's green, including an E2E run against the published v0.1.7 gateway. It needs the App to go live: without it, there are no update PRs for new core tags and no SDK release tags. Core is already atv0.1.8-pre.1, and the first SDK release,v0.1.7, waits on it too.The request above still stands:
ai-openshell-sdk-bot, installed onsdk-goonly, with the listed permissions, and the two repository secretsSDK_BOT_APP_IDandSDK_BOT_PRIVATE_KEY. The workflows in #6 narrow the token per job (contents,pull-requests,issues).ANTHROPIC_API_KEYcan wait until the adaptation workflow comes. Thanks!rhuss commentedon Nov 4, 2026
One correction to the request above: the App doesn't need
workflows: write. None of the workflows in #6 asks for it; they request onlycontents,pull-requests, andissues(plus the defaultmetadata: read). I removed it from the table. If the adaptation workflow ever needs to edit workflow files, I'll ask again then.rhuss commentedon Nov 6, 2026
The App works. With
ai-openshell-sdk-goinstalled and its two secrets in thesdk-botenvironment, #6 is merged and both workflows ran onmain:release-tagcreated SDK v0.1.7 at 7cc0b94, and the Go module proxy serves it.core-watchopened chore(core): track v0.1.8-pre.2 #19 for corev0.1.8-pre.2asai-openshell-sdk-go[bot], and CI runs on it. A second run skipped the tag as expected.Closing this. The
ANTHROPIC_API_KEYsecret mentioned above is only for the adaptation workflow, which isn't written yet; I'll open a separate request when it is.Thanks @SDAChess for setting it up.