Dispatch Incus sync via push-app-to-main app

community-scripts-pr-app lacks contents:write (only pull_requests:write), so
repository_dispatch returned 403. Switch to the push-app-to-main app, which
has contents:write.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A1R2A9UYwyL1FwcsADzSWU
This commit is contained in:
Michel Roegl-Brunner
2026-08-25 14:29:35 +02:00
parent f4199627ef
commit 31328336f8

12
.github/workflows/sync-to-incus.yml generated vendored
View File

@@ -10,9 +10,11 @@ name: Sync ct/install to Incus
# script. We therefore only fire a repository_dispatch and let that single
# source of truth do the work (and auto-approve + merge its own PR).
#
# Auth: the same GitHub App the other workflows here use (vars.APP_ID /
# secrets.APP_PRIVATE_KEY), with the token scoped to community-scripts/Incus.
# The app must be installed on the Incus repo with contents:write.
# Auth: the "push-app-to-main" GitHub App (vars.PUSH_MAIN_APP_ID /
# secrets.PUSH_MAIN_APP_SECRET), scoped to community-scripts/Incus. It has
# contents:write, which repository_dispatch requires (community-scripts-pr-app
# only has pull_requests:write, so it cannot dispatch). The app must be
# installed on the Incus repo.
on:
push:
@@ -36,8 +38,8 @@ jobs:
id: token
uses: actions/create-github-app-token@v3
with:
app-id: ${{ vars.APP_ID }}
private-key: ${{ secrets.APP_PRIVATE_KEY }}
app-id: ${{ vars.PUSH_MAIN_APP_ID }}
private-key: ${{ secrets.PUSH_MAIN_APP_SECRET }}
owner: community-scripts
repositories: Incus