ci: author, review, and automerge regen prs via github apps - #25
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Regen PRs are now authored with a convoy-sdk-bot GitHub App token (replacing the personal PAT), so CI triggers as before without depending on a user account. A separate reviewer app approves only diffs whose changed files all match the repo's generated paths; anything else is left unapproved with a comment for human review. Auto-merge is queued after approval, so unresolved finding conversations and the required checks (tests, Cursor Bugbot, Cursor Security Agent) still block the merge.
Note
Medium Risk
Automated approve-and-merge on regen PRs depends on correct app secrets and path allowlist; a misconfiguration could approve or merge unintended diffs, though checks and allowlist gates limit blast radius.
Overview
SDK generation now mints a convoy-sdk-bot GitHub App token for checkout, push, and opening regen PRs instead of
SDK_BOT_PAT/GITHUB_TOKEN, sopull_requestCI still runs. Commits are attributed toconvoy-sdk-bot[bot].After a regen diff is pushed, a second step uses an SDK reviewer app to approve only PRs authored by that bot whose changed files are entirely under
lib/convoy_api/orlib/convoy_api.rb(matchingscripts/generate.sh). Wrong author or out-of-allowlist paths get a PR comment and no approval (fail open to humans). On success it submits an APPROVE review and enables squash auto-merge via the bot token so downstream publish workflows still fire.Reviewed by Cursor Bugbot for commit 81687b9. Bugbot is set up for automated code reviews on this repo. Configure here.