Skip to content

fix(ci): unblock pro submodule fallback sync - #768

Merged
rafaelscosta merged 2 commits into
mainfrom
fix/pro-submodule-token-workflow
May 18, 2026
Merged

fix(ci): unblock pro submodule fallback sync#768
rafaelscosta merged 2 commits into
mainfrom
fix/pro-submodule-token-workflow

Conversation

@rafaelscosta

@rafaelscosta rafaelscosta commented May 18, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Collaborator

Summary

  • Clear the checkout-injected GitHub token extraheader when resolving aiox-pro via the authenticated PRO_SUBMODULE_TOKEN remote.
  • Use PRO_SUBMODULE_TOKEN for gh pr create/edit because the organization blocks GITHUB_TOKEN from creating pull requests.

Validation

  • npx yaml-lint .github/workflows/sync-pro-submodule.yml
  • Local git ls-remote simulation with a bogus checkout extraheader confirmed the explicit empty extraheader lets the authenticated Pro URL resolve refs/heads/main.
  • Rotated PRO_SUBMODULE_TOKEN and confirmed clone/update path works by manual dispatch with explicit target_sha; failure moved to PR creation, now addressed by this patch.

Fixes #762

Summary by CodeRabbit

  • Chores
    • Improved submodule synchronization workflow to more reliably resolve upstream targets when an explicit reference is not provided.
    • Switched PR creation authentication to use a stored repository secret, improving permission handling for automated updates.

Review Change Stack

@vercel

vercel Bot commented May 18, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
aiox-core Ready Ready Preview, Comment May 18, 2026 4:08pm

Request Review

@coderabbitai

coderabbitai Bot commented May 18, 2026 •
edited
Loading

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 9df5a7eb-6138-472d-ad6b-3e2a6f12c302

📥 Commits

Reviewing files that changed from the base of the PR and between fe30d60 and 02901c8.

📒 Files selected for processing (1)
  • .github/workflows/sync-pro-submodule.yml

Walkthrough

The Actions workflow now clears GitHub HTTP extra headers when resolving the upstream target SHA (using git -c http.https://github.com/.extraheader= with git ls-remote) and the PR creation step uses secrets.PRO_PR_TOKEN for GH_TOKEN instead of the default ${{ github.token }}.

Changes

Pro Submodule Sync Workflow

Layer / File(s) Summary
Git SHA resolution and PR creation authentication
.github/workflows/sync-pro-submodule.yml		 When target_sha input is empty, the "Resolve upstream target" step runs git ls-remote with -c http.https://github.com/.extraheader= to clear configured HTTP headers. The "Create or update PR" step sets GH_TOKEN from secrets.PRO_PR_TOKEN instead of ${{ github.token }}.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Suggested labels

area: workflows

Suggested reviewers

  • Pedrovaleriolopez
  • oalanicolas
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title 'fix(ci): unblock pro submodule fallback sync' clearly and specifically describes the main change—updating the workflow to resolve authentication issues with the pro submodule synchronization.
Linked Issues check ✅ Passed The pull request addresses issue #762 by implementing code fixes (git ls-remote config override, PRO_SUBMODULE_TOKEN usage) that resolve the workflow's authentication and PR creation failures, fulfilling the technical requirements.
Out of Scope Changes check ✅ Passed All changes are directly scoped to fixing the sync-pro-submodule workflow; no unrelated modifications to other files or functionality are present.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/pro-submodule-token-workflow

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions github-actions Bot added area: docs Documentation (docs/) area: devops CI/CD, GitHub Actions (.github/) labels May 18, 2026
@github-actions

github-actions Bot commented May 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

📊 Coverage Report

Coverage report not available

📈 Full coverage report available in Codecov

Generated by PR Automation (Story 6.1)

coderabbitai[bot]
coderabbitai Bot requested changes May 18, 2026
View reviewed changes

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/sync-pro-submodule.yml:
- Line 119: The workflow is reusing PRO_SUBMODULE_TOKEN (GH_TOKEN env) for
creating/editing PRs which either forces widening its scope or breaks PR writes;
create a dedicated write-scoped secret (e.g., PR_APP_TOKEN or PRO_PR_TOKEN) with
the correct app/ PAT permissions for gh pr create/edit, add that secret to the
workflow and replace GH_TOKEN: ${{ secrets.PRO_SUBMODULE_TOKEN }} with GH_TOKEN:
${{ secrets.PRO_PR_TOKEN }} (or analogous name) where gh pr create/edit is
invoked, and keep PRO_SUBMODULE_TOKEN restricted to read-only submodule access
so you don’t broaden its scope.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 7d291de1-f345-4306-8827-3fc86945f497

📥 Commits

Reviewing files that changed from the base of the PR and between dc4149d and fe30d60.

📒 Files selected for processing (1)
  • .github/workflows/sync-pro-submodule.yml

Comment thread .github/workflows/sync-pro-submodule.yml Outdated
@rafaelscosta
rafaelscosta merged commit 2149e8b into main May 18, 2026
37 checks passed
@rafaelscosta
rafaelscosta deleted the fix/pro-submodule-token-workflow branch May 18, 2026 16:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@coderabbitai coderabbitai[bot] coderabbitai[bot] approved these changes
@Pedrovaleriolopez Pedrovaleriolopez Awaiting requested review from Pedrovaleriolopez Pedrovaleriolopez is a code owner
@oalanicolas oalanicolas Awaiting requested review from oalanicolas oalanicolas is a code owner

Assignees

No one assigned

Labels

area: devops CI/CD, GitHub Actions (.github/) area: docs Documentation (docs/)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Sync Pro Submodule Fallback workflow failing daily — PRO_SUBMODULE_TOKEN expired

1 participant

@rafaelscosta