From 31328336f89b66b3870be68326a97e408871e7bd Mon Sep 17 00:00:00 2001 From: Michel Roegl-Brunner Date: Tue, 25 Aug 2026 14:29:35 +0200 Subject: [PATCH] Dispatch Incus sync via push-app-to-main app community-scripts-pr-app lacks contents:write (only pull_requests:write), so repository_dispatch returned 403. Switch to the push-app-to-main app, which has contents:write. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01A1R2A9UYwyL1FwcsADzSWU --- .github/workflows/sync-to-incus.yml | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/.github/workflows/sync-to-incus.yml b/.github/workflows/sync-to-incus.yml index 22293b55f..cb8e932df 100644 --- a/.github/workflows/sync-to-incus.yml +++ b/.github/workflows/sync-to-incus.yml @@ -10,9 +10,11 @@ name: Sync ct/install to Incus # script. We therefore only fire a repository_dispatch and let that single # source of truth do the work (and auto-approve + merge its own PR). # -# Auth: the same GitHub App the other workflows here use (vars.APP_ID / -# secrets.APP_PRIVATE_KEY), with the token scoped to community-scripts/Incus. -# The app must be installed on the Incus repo with contents:write. +# Auth: the "push-app-to-main" GitHub App (vars.PUSH_MAIN_APP_ID / +# secrets.PUSH_MAIN_APP_SECRET), scoped to community-scripts/Incus. It has +# contents:write, which repository_dispatch requires (community-scripts-pr-app +# only has pull_requests:write, so it cannot dispatch). The app must be +# installed on the Incus repo. on: push: @@ -36,8 +38,8 @@ jobs: id: token uses: actions/create-github-app-token@v3 with: - app-id: ${{ vars.APP_ID }} - private-key: ${{ secrets.APP_PRIVATE_KEY }} + app-id: ${{ vars.PUSH_MAIN_APP_ID }} + private-key: ${{ secrets.PUSH_MAIN_APP_SECRET }} owner: community-scripts repositories: Incus