Skip to content

[ci-maintainer] meeting-recordings-refresh PR #331 blocked: required Lint and build never runs while MEETING_REFRESH_APP_* secrets are unprovisioned #335

Open
Open
[ci-maintainer] meeting-recordings-refresh PR #331 blocked: required Lint and build never runs while MEETING_REFRESH_APP_* secrets are unprovisioned#335
Labels
agent/ci-maintainerCreated by Hive for agent-filed issue provenanceciCreated by Hive for agent-filed issue provenanceneeds-decisionWaiting on a maintainer decision; not contributor work until a human clears the labelstage/085-needs-decision

Description

@hivecommons-hive
hivecommons-hive
bot
opened on Oct 14, 2026

CI Issue

The daily Refresh meeting recordings PR is now permanently blocked from merging until the two App secrets from #296 are provisioned.

#305 (merged 6cbb1e8) made meeting-recordings-refresh.yml mint an App token via actions/create-github-app-token only when MEETING_REFRESH_APP_ID / MEETING_REFRESH_APP_PRIVATE_KEY exist, falling back to GITHUB_TOKEN otherwise. The secrets have not been provisioned, so the fallback is still in effect and the PR is still authored with GITHUB_TOKEN — which means GitHub creates its pull_request runs with zero jobs (action_required) and no check-run ever lands on the head SHA.

What changed since #296: Lint and build is now a required status check on main (maintainer half of #296, 2026-10-10). That correctly stops a zero-check head from merging — but it also means the automation PR can no longer merge at all, because the only thing that would produce Lint and build on its head is the App-token path that is skipped.

Evidence

Recommendation

Needs a human — no code change can close this. @clubanderson (per the /hive decision A on #296):

  • Create a GitHub App (or reuse an existing hivecommons App) with contents: write + pull-requests: write on hivecommons/docs, installed on the repo.
  • Add repo secrets MEETING_REFRESH_APP_ID and MEETING_REFRESH_APP_PRIVATE_KEY (Settings → Secrets and variables → Actions).
  • Re-run Refresh meeting recordings via workflow_dispatch (or wait for the 12:17 UTC cron). The next run updates the automation/meeting-recordings-refresh branch; confirm Lint and build and npm audit check-runs appear on the new head SHA of docs: refresh community meeting recordings #331 and that mergeable_state leaves blocked.

Until then, #331 (and every daily refresh after it, since create-pull-request reuses the same branch) will sit open with tide: pending. If the App route is not wanted, the alternative is removing Lint and build from the required checks and accepting unverified data-only merges — but that re-opens the #296 gap and is not recommended.

No workflow edit is needed for option A as already merged; nothing here is pushable by this lane.

Filed by ci-maintainer agent (ACMM L6 — full mode)

🐝 Hive Agent: ci-maintainer | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88

Activity

  1. hivecommons-hive
    added
    hive/hosted-available-oke-11-placeholder-r05x
    ciCreated by Hive for agent-filed issue provenance
    agent/ci-maintainerCreated by Hive for agent-filed issue provenance
    needs-decisionWaiting on a maintainer decision; not contributor work until a human clears the label
    on Oct 14, 2026

  2. hivecommons-hive commented on Oct 14, 2026

    @hivecommons-hive
    hivecommons-hivebot
    on Oct 14, 2026 – with hivecommons-hive
    ContributorAuthor

    What to reply

    • /hive approve: go with the recommendation
    • /hive decision <your instructions>: go ahead, following your instructions
    • /hive help: show these again

    If this issue is waiting only for reporter confirmation after a merged fix, the reporter or a maintainer can reply /fixed instead.

    Only a maintainer with write access can un-park; everything else is ignored. Full command reference: https://github.com/hivecommons/hive/blob/v5/src/docs/maintainer-commands.md.

  3. clubanderson commented on Oct 16, 2026

    @clubanderson
    clubanderson
    on Oct 16, 2026
    Member

    Decision brief

    Question: How do the daily Refresh meeting recordings PRs (#331 and successors) get the now-required Lint and build check to run, given the workflow still falls back to GITHUB_TOKEN?

    Context: The decision was already taken on #296 (/hive decision A — App token, 2026-10-10). The workflow half is merged (#305). What remains is not a decision but a human-only action: the repo secrets are still unprovisioned (actions secrets today: NETLIFY_BUILD_HOOK_URL only), so #331 sits BLOCKED. No agent has permission to create an App or write secrets.

    Options (reply with a number)

    1. Finish A — create/reuse a hivecommons GitHub App (contents: write, pull_requests: write, installed on hivecommons/docs), add MEETING_REFRESH_APP_ID + MEETING_REFRESH_APP_PRIVATE_KEY, run workflow_dispatch. ~10 min, no code change, fully reversible. The hive will then verify check-runs on the new head of docs: refresh community meeting recordings #331 and close this + [quality] provision MEETING_REFRESH_APP_ID/PRIVATE_KEY secrets — refresh PRs still fall back to GITHUB_TOKEN so Vitest/TypeScript never run (#331) #337.
    2. Fine-grained PAT instead — if an App is unwanted: store a PAT (same two scopes) as a secret; the hive opens a small workflow PR swapping create-github-app-token for the PAT. Cheaper to set up, but tied to a person's account and expires.
    3. Drop Lint and build from required checks — refresh PRs merge on DCO+Netlify only. Re-opens the [ci-maintainer] meeting-recordings-refresh PR is opened with GITHUB_TOKEN so Build/npm audit never run on it; #293 merged with zero check-runs #296 gap (unverified data-only merges). Not recommended.

    Recommendation: 1 — it is the already-recorded decision; only the provisioning step is outstanding.

    Housekeeping: #337 is the same finding (dedupe pass agreed) — close it as a duplicate of this issue once secrets exist. Leaving needs-decision in place because the next step is yours, not the hive's.

    — decision brief prepared for the operator by the hive's maintainer session

  4. clubanderson commented on Oct 16, 2026

    @clubanderson
    clubanderson
    on Oct 16, 2026
    Member

    Operator follow-up on option 1:

    The existing hive GitHub App hivecommons-hive (app_id 3568013, installation 158510457) already has contents: write + pull_requests: write on every hivecommons repo including docs, so no new App is needed. Its private key lives on hive's own spoke at /data/gh-app-key-3568013.pem. Provisioning is a 2-command step, but it copies an org-wide write key into this repo's Actions secrets, so it's deliberately left for a human to run:

    NS=hive-hosted-hosted-available-oke-11-placeholder-r05x
unset GITHUB_TOKEN
gh secret set MEETING_REFRESH_APP_ID --repo hivecommons/docs --body 3568013
kubectl --context hive-oke -n $NS exec deploy/hive -c hive -- cat /data/gh-app-key-3568013.pem \
  | gh secret set MEETING_REFRESH_APP_PRIVATE_KEY --repo hivecommons/docs
gh workflow run refresh-meeting-recordings.yml --repo hivecommons/docs

    Recommend adding repositories: docs to the actions/create-github-app-token step so the minted token is scoped to this repo only. Once run, the hive will verify check-runs on #331 and close this + #337.

  5. hivecommons-hive
    added
    stage/085-needs-decision
    and removed
    hive/hosted-available-oke-11-placeholder-r05x
    on Oct 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    agent/ci-maintainerCreated by Hive for agent-filed issue provenanceciCreated by Hive for agent-filed issue provenanceneeds-decisionWaiting on a maintainer decision; not contributor work until a human clears the labelstage/085-needs-decision

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions