Skip to content

[XAPI-2340] Open a PR for OAuth2Client version bumps instead of pushing to master - #664

Merged
the-chris-mitchell merged 2 commits into
masterfrom
xapi-2340-fix-client-publish-pr-flow
Aug 10, 2026
Merged

[XAPI-2340] Open a PR for OAuth2Client version bumps instead of pushing to master#664
the-chris-mitchell merged 2 commits into
masterfrom
xapi-2340-fix-client-publish-pr-flow

Conversation

@the-chris-mitchell

@the-chris-mitchell the-chris-mitchell commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Found while testing the Trusted Publishing switch ([XAPI-2340] Switch NuGet publishing to Trusted Publishing (OIDC) #663): the Commit, Push and Tag step in publish-Oauth2Client-package.yml pushes directly to master, but master is a protected branch requiring a PR + the build-test-lint status check. Every prior "successful" run of this workflow had actually short-circuited before this step (no changes detected), so this direct push has likely never worked when there were real changes to publish. See run 31353584005 for the failure.
  • Confirmed the default GITHUB_TOKEN can't be granted bypass on the ruleset — bypass actors are limited to specific roles, teams, installed GitHub Apps, or Dependabot, not the generic Actions token identity.
  • Replaced the direct push with: commit the version bump on a new branch → push the branch → tag the commit (tags aren't covered by the branch ruleset) → open a PR into master → surface the PR URL in the job's $GITHUB_STEP_SUMMARY.

Prerequisite to verify

  • Actions must be allowed to create pull requests on this repo: Settings → Actions → General → Workflow permissions → "Allow GitHub Actions to create and approve pull requests". If this is off, gh pr create in the new step will fail.

Test plan

  • Confirm the "Allow GitHub Actions to create and approve pull requests" setting is enabled
  • Manually trigger Publish OAuth2Client Package with a real OAuth2Client change and confirm the new step opens a PR and the step summary links to it
  • Merge the resulting PR and confirm the tag/version stay in sync for the next run

Jira: https://xero.atlassian.net/browse/XAPI-2340

🤖 Generated with Claude Code

@the-chris-mitchell
the-chris-mitchell marked this pull request as ready for review August 10, 2026 04:24

@ryanNexus ryanNexus left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🔥

Chris Mitchell added 2 commits August 10, 2026 16:48
…ng to master

master is a protected branch requiring PRs and a passing status check, so the
workflow's direct `git push origin HEAD:master` always failed once there were
actual changes to publish (every prior "successful" run had short-circuited
before reaching this step). The version bump commit and tag are now pushed to
a branch and opened as a PR instead, with the PR URL surfaced in the job's
step summary.
@the-chris-mitchell
the-chris-mitchell force-pushed the xapi-2340-fix-client-publish-pr-flow branch from f9bb1c2 to abc88a2 Compare August 10, 2026 04:48
@the-chris-mitchell
the-chris-mitchell merged commit 4d2e168 into master Aug 10, 2026
7 checks passed
@the-chris-mitchell
the-chris-mitchell deleted the xapi-2340-fix-client-publish-pr-flow branch August 10, 2026 04:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants