Conversation
This PR updates the codegen files. Co-authored-by: ptr727-codegen[bot] <275599072+ptr727-codegen[bot]@users.noreply.github.com>
…90) ## Summary Bundles two GitHub-Actions hygiene fixes: - **Closes#88** — `actions/create-github-app-token` deprecated the numeric `app-id` input in [v3.0.0 (2026-03-14)](https://github.com/actions/create-github-app-token/releases/tag/v3.0.0) in favor of `client-id`. Bumps the SHA pin from `v1.12.0` → `v3.2.0` across all four call sites, renames secret `CODEGEN_APP_ID` → `CODEGEN_APP_CLIENT_ID`, and reworks README setup guidance to point at the App's **Client ID** (a different identifier than the numeric App ID — both are visible on the App settings page). - **Closes#89** — drops `codegen` from `test-pull-request.yml`'s `pull_request.branches` filter. The filter matches the PR's *base* ref, not the head; no PR in this repo targets a `codegen` base (codegen PRs target `main`/`develop` with head refs `codegen-main`/`codegen-develop`), so the entry was inert. Also opportunistically replaces the absolute "agents never commit" rule in `AGENTS.md` with a scope-bound authorization model: agents may commit when explicitly asked **and** signing is configured in the environment; without signing wired up they still stop at `git add`. Branch protection's signed-commit requirement is unchanged — unsigned commits are rejected on push regardless. ## Pre-merge maintainer step The `CODEGEN_APP_CLIENT_ID` secret must exist in **both** the Actions and Dependabot secret stores before merging (already provisioned). The legacy `CODEGEN_APP_ID` secret should be left in place until one round of each bot workflow runs green post-merge, then deleted. ## Test plan - [ ] CI green on this PR (`Check pull request workflow status`). - [ ] Post-merge: trigger `run-periodic-codegen-pull-request.yml` via `workflow_dispatch`; both matrix legs (`main`, `develop`) generate an App token, open a codegen PR as `ptr727-codegen[bot]`, and auto-merge. - [ ] Post-merge: next Dependabot PR exercises `merge-bot-pull-request.yml` `merge-dependabot` cleanly. - [ ] Verify `disable-auto-merge-on-maintainer-push` job still fires when a maintainer pushes to a bot PR (next-time-it-happens check). - [ ] After one green round of each bot workflow, delete legacy `CODEGEN_APP_ID` secret from both Actions and Dependabot stores.
Contributor
There was a problem hiding this comment.
Pull request overview
Promotes develop → main while modernizing the GitHub App token pattern used by bot workflows (moving from deprecated app-id/CODEGEN_APP_ID to client-id/CODEGEN_APP_CLIENT_ID) and removing an inert PR base-branch filter entry.
Changes:
- Update all
actions/create-github-app-tokencall sites to v3.2.0 (SHA-pinned) and switch input fromapp-idtoclient-idusingCODEGEN_APP_CLIENT_ID. - Update documentation and agent guidance to reflect the Client ID secret and a signing-gated “agent may commit when explicitly authorized” model.
- Remove
codegenfrom thepull_request.branchesfilter intest-pull-request.ymland refresh the weekly codegen timestamp.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| README.md | Updates GitHub App setup guidance to use Client ID + CODEGEN_APP_CLIENT_ID. |
| CodeGen/CodeGen.cs | Updates the generated timestamp string used by the codegen output/logging. |
| AGENTS.md | Refines agent git/commit guidance (signed commits only) and documents Client ID usage for App-token workflows. |
| .github/workflows/test-pull-request.yml | Removes the inert codegen base-branch filter entry from PR triggers. |
| .github/workflows/run-codegen-pull-request-task.yml | Renames the reusable workflow secret to CODEGEN_APP_CLIENT_ID and switches token minting to client-id on v3.2.0. |
| .github/workflows/merge-bot-pull-request.yml | Switches all bot-merge token minting steps to client-id and pins actions/create-github-app-token to v3.2.0. |
4 tasks
…onflicts (#92) ## Summary Eliminates the recurring `develop → main` merge conflict on `CodeGen/CodeGen.cs`. PR #91 surfaced the issue: the codegen matrix's two legs (main, develop) each embed their own `DateTime.UtcNow:o`, so the generated file diverges every codegen cycle and every release merge conflicts on the same line. The conflict also blocks GitHub from computing the PR merge ref, which is why no `pull_request` workflow could fire on PR #91. ## Changes - **CodeGen project**: new optional `--runtime` / `-r` CLI flag. When set, the value is embedded verbatim as the file's `dateTime` constant; when omitted, behavior is unchanged (`DateTime.UtcNow.ToString("o")`). [`CommandLine.cs`](CodeGen/CommandLine.cs), [`CodeGenBuilder.cs`](CodeGen/CodeGenBuilder.cs), [`Program.cs`](CodeGen/Program.cs). - **Codegen workflow**: passes `--runtime "${{ github.run_started_at }}"` so both matrix legs in a single invocation receive the same string and emit byte-identical `CodeGen.cs`. [`.github/workflows/run-codegen-pull-request-task.yml`](.github/workflows/run-codegen-pull-request-task.yml). - **`CodeGen/CodeGen.cs`**: pin develop's timestamp to main's already-released value, so the *currently-open* PR #91 unblocks and the next codegen run starts both branches from the same string. - **`AGENTS.md`**: documents the dual-target-codegen + per-run-state pitfall and labels the `--runtime` plumbing as template-internal hygiene, not a generator pattern derived projects should reproduce. ## Scope note (per the user) Per-run-unique output from a codegen demo is **expected**. The `--runtime` flag exists *only* because this template runs the same demo generator on two release branches in parallel; passing a shared timestamp keeps releases from blocking on the resulting textual conflicts. Derived projects' real generators should be deterministic given the same inputs, or be scoped to a single release branch, or accept the per-release merge cost — **not** copy this `--runtime` plumbing. Inline comments at [CodeGenBuilder.cs:7-13](CodeGen/CodeGenBuilder.cs#L7-L13), [CommandLine.cs:67-73](CodeGen/CommandLine.cs#L67-L73), and [run-codegen-pull-request-task.yml:67-74](.github/workflows/run-codegen-pull-request-task.yml#L67-L74) repeat this so each touchpoint is self-explanatory. ## Test plan - [ ] CI green on this PR. - [ ] Local smoke test (already verified): `dotnet run --project CodeGen/CodeGen.csproj -- --codepath /tmp/x --runtime "2026-05-24T20:00:00Z"` produces `dateTime = "2026-05-24T20:00:00Z"`; omitting `--runtime` produces a `DateTime.UtcNow:o`-style value as before. - [ ] After merge, the existing PR #91 (develop → main) refreshes to a conflict-free state, `pull_request` workflows fire on it, and it can merge cleanly. - [ ] Next scheduled `run-periodic-codegen-pull-request.yml`: both matrix legs produce identical `CodeGen/CodeGen.cs` content.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Promotes develop → main. Two squashed commits ride along:
actions/create-github-app-tokenfrom deprecatedapp-idtoclient-id(closesMigrate from deprecated 'app-id' to 'client-id' for GitHub App token #88), bump pinv1.12.0→v3.2.0, drop inertcodegenentry fromtest-pull-request.yml's base-branch filter (closestest-pull-request.yml: 'codegen' base-branch filter has no effect #89), and relaxAGENTS.md's "agents never commit" rule to allow scope-bound, signing-gated authorization. 5 files, 16+/17-.[ptr727-codegen]weekly codegen refresh; 1 line inCodeGen/CodeGen.cs.The
CODEGEN_APP_CLIENT_IDsecret is already provisioned in both Actions and Dependabot stores. The legacyCODEGEN_APP_IDsecret can be deleted after one round of each bot workflow runs green on main post-merge.Test plan
run-periodic-codegen-pull-request.ymlviaworkflow_dispatch; both matrix legs (main, develop) mint App tokens and open codegen PRs asptr727-codegen[bot].merge-bot-pull-request.ymlmerge-dependabot.CODEGEN_APP_IDsecret from both Actions and Dependabot stores.