Repository navigation
Bump version: push with a deploy key past a ruleset - #42
Merged
Merged
Conversation
A ruleset that asks for a pull request or status checks refuses the GITHUB_TOKEN (GH013), and the token cannot be on the bypass list. The optional secret deploy-key checks out and pushes with a deploy key, which can be. Its tag push starts on: push workflows, so the release workflow is not started a second time. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y3rdfXpBafq4kFbwiY2UFF
firsttris
added a commit
to firsttris/haben
that referenced
this pull request
Nov 8, 2026
## Anlass Der Button *Bump version* schlägt seit dem Ruleset auf `main` fehl ([Lauf](https://github.com/firsttris/haben/actions/runs/42470263138)): ``` remote: error: GH013: Repository rule violations found for refs/heads/main. remote: - Changes must be made through a pull request. remote: - 8 of 8 required status checks are expected. ``` Den `GITHUB_TOKEN` kann man nicht auf die Bypass-Liste eines Rulesets setzen, einen Deploy Key schon. ## Änderung - `.github/workflows/bump.yml`: gibt das Secret `BUMP_DEPLOY_KEY` als `deploy-key` an den gemeinsamen Workflow weiter, der auf den Stand von firsttris/workflows#42 gepinnt ist (Commit `2ef860c`, der Head dieses PRs). - `docs/entwicklung.md` (Veröffentlichen): Deploy Key und Bypass-Liste beschrieben; der lokale Weg geht nur noch für Leute auf der Bypass-Liste. Deploy Key mit Schreibrecht, Secret `BUMP_DEPLOY_KEY` und „Deploy keys“ auf der Bypass-Liste sind schon eingerichtet. ## Reihenfolge 1. firsttris/workflows#42 mergen. 2. Optional den Pin hier auf den Squash-Commit von #42 heben. Bis dahin bleibt `2ef860c` über `refs/pull/42/head` erreichbar, und Renovate hebt den Pin ohnehin. 3. Diesen PR mergen, dann Actions → *Bump version* → `patch` (0.6.3; der fehlgeschlagene Lauf hat nichts hinterlassen). ## Prüfungen Nur Workflow- und Doku-Änderungen: YAML geparst, actionlint läuft in der CI. `zensical build --strict` habe ich nicht lokal ausgeführt. Lint, Typecheck, Tests und Build betrifft die Änderung nicht. --- _Generated by [Claude Code](https://claude.ai/code/session_01Y3rdfXpBafq4kFbwiY2UFF)_ Co-authored-by: Claude <noreply@anthropic.com>
firsttris
added a commit
to firsttris/haben
that referenced
this pull request
Nov 8, 2026
…pinnen (#398) ## Anlass Nach #397 endete *Bump version* mit `startup_failure` ([Lauf](https://github.com/firsttris/haben/actions/runs/42473190896)): ``` error parsing called workflow ".github/workflows/bump.yml" -> "firsttris/workflows/.github/workflows/bump-version.yml@2ef860cd1cbc78263aa5c5ad580624ab8b607c8a" : workflow was not found. ``` `2ef860c` war der Head von firsttris/workflows#42. Nach dem Squash-Merge und dem Löschen des Branches liegt er nur noch unter `refs/pull/42/head`, und dort findet Actions keine Reusable Workflows. Meine Annahme in #397, dass der Pin erreichbar bleibt, war falsch. ## Änderung `.github/workflows/bump.yml` pinnt auf `b66b54d`, den Squash-Commit von #42 auf `main` von firsttris/workflows. Der Inhalt ist derselbe wie bei `2ef860c`. --- _Generated by [Claude Code](https://claude.ai/code/session_01Y3rdfXpBafq4kFbwiY2UFF)_ Co-authored-by: Claude <noreply@anthropic.com>
firsttris
added a commit
that referenced
this pull request
Nov 8, 2026
Like bump-version.yml (#42): the optional secret deploy-key checks out and pushes with a deploy key on the ruleset's bypass list. The Playwright image brings openssh-client (utils/docker/Dockerfile.noble in microsoft/playwright). Claude-Session: https://claude.ai/code/session_01Y3rdfXpBafq4kFbwiY2UFF Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
In firsttris/haben a ruleset on
main(pull request + 8 status checks) now refuses the push of Bump version:(run https://github.com/firsttris/haben/actions/runs/42470263138). The
GITHUB_TOKENcannot be put on a ruleset's bypass list; a deploy key can.What
bump-version.yml: optional secretdeploy-key, passed toactions/checkoutasssh-key, so the commit and tag are pushed with the deploy key. Without it nothing changes (emptyssh-key=GITHUB_TOKEN).on: pushworkflows, so the release workflow already starts on the tag; thegh workflow runstep is skipped then to avoid a second release run.tested-on-maincomment and README note that such a release commit runs the CI.Checks
YAML parses; actionlint runs in the Lint workflow of this PR (not run locally).
Generated by Claude Code