Repository navigation
chore: drop unused upstream workflows; pin .github/workflows during sync - #4
Merged
Merged
Conversation
The fork follows upstream releases wholesale: dependency upgrades, code scanning and issue gardening happen upstream, no need to burn this repository's Actions minutes on them. Dropped: - close-bugs-bot / close-features-bot / stale-bot (upstream issue triage bots - never ran here) - codeql (done upstream) - dotnet-upgrade / node-upgrade / docker-buildx-upgrade / npm-audit / npm-audit-typescript (dependency automation we do not want) - dependency-check (manual dep audit, same category) - .github/dependabot.yml (daily dep PRs, same category) Kept: build (Runner CI), release (Runner CD), docker-publish (fork-patched GHCR publisher, manual).
The GITHUB_TOKEN cannot create or update workflow files, so a push
carrying workflow deltas is always rejected:
! [remote rejected] (refusing to allow a GitHub App to create or
update workflow ... without `workflows` permission)
and no GITHUB_TOKEN permission scope exists that changes that.
Fix the sync flow instead: merge with --no-commit, then mirror
.github/workflows from origin/main over the merge result and write the
fork version into the version files before concluding the merge. The
pushed branch therefore never carries workflow-file deltas, upstream
cannot resurrect the workflows we dropped, and the version-file
conflicts that happen on every sync are resolved as a side effect.
Also clean up the fork-sync.yml permissions block (the actions: write
hand-fix was unnecessary) and renumber the script step comments.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the
Fork syncpush rejection permanently and finishes the workflow cleanup.Why the push kept failing
There is no GITHUB_TOKEN permission scope that allows pushing workflow-file changes —
workflows:is not a valid key, andactions: writeis unrelated. The token is simply never allowed to update.github/workflows/*, so any sync branch carrying workflow deltas will be rejected:The fix: the fork owns
.github/workflowsfork-sync.shnow merges with--no-commit, then before concluding the merge:.github/workflowsfromorigin/mainover the merge result — upstream workflow changes and re-additions are dropped, our dropped files stay droppedreleaseVersion/src/runnerversion(the two files that conflict by construction on every sync)The pushed branch therefore carries zero workflow deltas → the standard token can push it → no PAT, no secrets, nothing to maintain.
Workflow cleanup
Dropped (on top of the unstaged deletions staged here):
dependency-check.yml— manual dep audit, same category as the upgrade automationdocker-buildx-upgrade.yml— weekly dep-PR generator, same family as dotnet/node-upgrade.github/dependabot.yml— daily dep PRs for docker/actions/nuget/npmKept:
build.yml(Runner CI),release.yml(Runner CD),docker-publish.yml(fork-patched GHCR publisher — manual entrypoint, say the word if it moved elsewhere and it goes too),fork-sync,fork-patches.Verified in a sandbox with a hostile fixture
Upstream "release" that modifies kept workflows, modifies deleted ones (modify/delete conflicts), and adds a brand-new workflow: merge concluded unattended,
git diff origin/main..sync-branch -- .github/workflowsis empty, workflow dir is exactly the fork's 5 files, version2.10337.0, patch gate green, real upstream changes (docs/images/src) still flow through.After merge
Trigger
Fork syncmanually (gh workflow run 'Fork sync' -R AdguardTeam/runner) — it should finally open thechore: sync with upstream 2.337.0PR.