fix: point publish.yml at the org App secrets that exist - #5
Merged
Conversation
This receiver referenced PROMOTION_APP_ID / PROMOTION_APP_PRIVATE_KEY. Those names were invented by the source repo's scaffold and exist nowhere. The App already exists org-wide as CLIENT_ID_GHAPP_WRITE / PRIVATE_KEY_GHAPP_WRITE — the same pair deriv-com/deriv-api-schemas uses to drive its own cross-repo publish.yml with the same actions/create-github-app-token. No new App or secrets are needed; this repo just has to be granted access to them. Applied here directly rather than waiting for promotion: this workflow has to be able to receive the very first dispatch, and the scaffold copy only reaches this repo on a promotion that has not run yet. The matching change in the source repo's scaffold is deriv-api-plugin-specs#133, so the two copies stay in step. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Manifest Files |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This receiver referenced
PROMOTION_APP_ID/PROMOTION_APP_PRIVATE_KEY. Those names were invented by the source repo's scaffold and exist nowhere.The App already exists org-wide as
CLIENT_ID_GHAPP_WRITE/PRIVATE_KEY_GHAPP_WRITE— the same pairderiv-com/deriv-api-schemasuses to drive its own cross-repopublish.yml, with the sameactions/create-github-app-token. So no new App and no new secrets are needed; this repo just has to be granted access to them (it currently has no org secrets at all, while the source repo already has these).Why directly here rather than via promotion: this workflow has to be able to receive the very first dispatch. The scaffold copy only reaches this repo on a promotion that has not run yet — chicken and egg.
The matching change to the scaffold in the source repo is deriv-com/deriv-api-plugin-specs#133, so the two copies stay in step and the next promotion is a no-op on this file.
Two lines plus a header comment. No logic touched. This workflow remains inert until an admin grants the secrets and sets
vars.PROMOTION_SOURCE_REPO.