From 6865d71fd43bdabb662672d8f56daca3007ac617 Mon Sep 17 00:00:00 2001 From: Pedro Gomes Date: Sat, 22 Aug 2026 06:01:30 +0100 Subject: [PATCH] chore(repo): slim .gt-repo.yaml, and catch up four gt releases MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit gt 1.3.0 writes only what differs from its defaults. This file was the fully resolved spec, so it pinned all ~25 of them — and a repository that pins a default has silently stopped tracking it, which meant changing an opinion in gt would have reached nobody. 84 lines to 39, with no change to how this repository is governed: 'gt repo config' is identical before and after apart from the gt_version stamp. That stamp was still 1.0.0, so the same sync also picks up a fix this repository had been missing since: dependabot-auto-merge.yml now passes APP_CLIENT_ID and APP_PRIVATE_KEY explicitly rather than relying on 'secrets: inherit', which is documented as working only within one organization and silently passes nothing when the called workflow lives under another owner — as gt's does. Both are optional and resolve to the empty string where no bot App exists. --- .github/workflows/dependabot-auto-merge.yml | 10 ++++ .gt-repo.yaml | 57 +++------------------ 2 files changed, 16 insertions(+), 51 deletions(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 3ba236d..42d98e9 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -26,3 +26,13 @@ permissions: jobs: auto-merge: uses: pedromvgomes/gt/.github/workflows/reusable-dependabot-auto-merge.yml@v1 + # Named, not inherited: `secrets: inherit` is documented as working for + # reusable workflows "in the same organization or enterprise", and gt lives + # under a different owner than the repositories calling it. The bulwark + # stage lost its Codecov token to exactly that, silently. + # + # Both are optional and resolve to the empty string where the organization + # has no bot App, which the called workflow treats as "not configured". + secrets: + APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }} + APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }} diff --git a/.gt-repo.yaml b/.gt-repo.yaml index c93148a..d08c9b0 100644 --- a/.gt-repo.yaml +++ b/.gt-repo.yaml @@ -9,8 +9,13 @@ # ci-*/cd-* workflow that belongs to this repository: gt creates those once and # never touches them again. Branch protection needs exactly one check, ci-gate, # which waits on all of them. +# +# Only deliberate overrides are written here. Everything absent follows gt's +# default and keeps following it as that default changes — a value pinned in +# this file stops tracking gt, which is why sync removes the ones that merely +# restate it. Run 'gt repo config' to see the resolved spec, defaults included. -gt_version: 1.0.0 +gt_version: 1.3.0 dependabot: - ecosystem: github-actions directory: / @@ -26,61 +31,11 @@ dependabot: Fix on such a PR with: yarn --cwd web build && cp web/dist/index.html internal/dashboard/assets/index.html -dependabot_auto_merge: - enabled: true - schedule: 0 1 * * * - max_bump: minor - delete_branch: true -bulwark: - enabled: true pipeline: ci: - enabled: true stages: - preflight - build - test - merge_queue: false cd: enabled: false - stages: - - preflight - - publish - - deploy - - verify - tags: - - v*.*.* -conventional_commits: - enabled: true - scope: pr_title - types: - - feat - - fix - - docs - - style - - refactor - - perf - - test - - build - - ci - - chore - - revert -settings: - merge: - squash: true - merge_commit: false - rebase: false - delete_branch_on_merge: true - squash_title: pr_title - squash_message: blank - branch_protection: - branch: main - required_approvals: 0 - require_up_to_date: false - dismiss_stale_reviews: true - require_thread_resolution: true - require_code_owner_review: false - require_last_push_approval: false -files: - - sync - - dependabot-auto-merge