fix(ci): use repository token for spam minimization - #9140
Conversation
|
Thanks for the PR! Template looks good ✓ Problem: observed bug with solid evidence. I pulled the cited schedule run (31778078141, today, Direction: aligned — this restores broken repo-hygiene automation and does so by narrowing credential scope (shared PAT → repository-scoped Size: no core paths touched. Production change is 2 lines (one env value in the workflow YAML); the remaining 11 changed lines live in the regression test file, which the size gate excludes. No core-module concerns. Approach: minimal and right-sized. The only simpler alternative — re-scoping the shared PAT — would widen a shared secret instead of using the token the workflow already provisions with exactly the right permissions, so the chosen path is strictly better. Nice touch tightening the regression guard to pin the exact token value, so reverting to the under-scoped PAT fails CI loudly instead of passing silently. Risk: no high-risk path matches. No elevated risk signals. Moving on to code review. 🔍 中文说明感谢贡献! 模板完整 ✓ 问题: 已观测到的 bug,证据充分。核实了引用的定时运行(31778078141,今天,main 分支),日志确认:命中的 7 条评论全部因 方向: 对齐——这是修复已失效的仓库维护自动化,且方式是收窄凭证权限(共享 PAT → 仓库级 规模: 未触及核心路径。生产改动仅 2 行(workflow YAML 中一个 env 值),其余 11 行改动在回归测试文件中,规模门禁不计入。无核心模块问题。 方案: 最小且恰当。唯一更简单的替代方案——调整共享 PAT 的 scope——会扩大共享密钥的权限,而这里选用 workflow 原生就已具备恰好所需权限的 token,严格更优。回归护栏收紧为固定校验 token 的具体取值也是加分项:今后换回权限不足的 PAT 会在 CI 中直接失败,而不是静默通过。 风险: 未命中高风险路径。无升级风险信号。 进入代码审查 🔍 — Qwen Code · qwen3.8-max Reviewed at |
Code reviewMy independent proposal for "under-scoped PAT breaks No blockers. Notes from reading it:
Test evidence — the PR's own CI, via APIThe updated guard is in CI's
Not verified: the live GraphQL write path. Deliberately — dispatching Unattended CI run — no tmux real-scenario testing; nothing user-visible about the product changes either way. 中文说明代码审查看 diff 之前,我对"权限不足的 PAT 导致 minimizeComment 失败"的独立方案就是本 PR 的做法:移除凭证覆盖,改用 workflow 原生 无阻塞项。审查笔记:
测试证据 —— 来自 PR 自身 CI(API 拉取)更新后的护栏在 CI 的 未验证:线上 GraphQL 写路径。这是有意为之——从 PR 分支触发 无人值守 CI 运行——无 tmux 真实场景测试;本改动也没有任何用户可见的产品行为。 — Qwen Code · qwen3.8-max Reviewed at |
|
Confidence: 5/5 — evidence-backed one-line credential fix with a minimal guard tightening and no blockers; approval deferred only to let CI land green. This is what a good fix looks like. The problem was real and quantified (7/7 failures in today's schedule run, every one One CI run is still pending on this commit (the ubuntu Test job that exercises the updated helper tests), so approval is deferred until CI lands green on 中文说明置信度:5/5 —— 证据充分的一行凭证修复,配套最小护栏收紧,无阻塞项;仅等 CI 变绿后批准。 这是标准的好修复。问题真实且可量化(今天的定时运行 7/7 全部失败,均为 该 commit 还有一个 CI 运行未完成(执行更新后 helper 测试的 ubuntu Test 任务),因此批准推迟到 CI 在 — Qwen Code · qwen3.8-max Reviewed at |
|
Post-merge verification completed successfully. The workflow was manually dispatched on
Affected PRs:
This is a successful result example for the repository-token path introduced by this PR. |
Code Coverage Summary
CLI Package - Full Text ReportCore Package - Full Text ReportFor detailed HTML reports, please see the 'coverage-reports-22.x-ubuntu-latest' artifact from the main CI run. |
What this PR does
Uses the workflow's repository-scoped
GITHUB_TOKENfor spam minimization instead of the shared bot PAT. It also tightens the existing regression guard so switching back to the under-scoped PAT fails locally.Why it's needed
The scheduled workflow correctly finds comments from blocklisted users, but every
minimizeCommentmutation fails withINSUFFICIENT_SCOPES. The shared PAT has onlypublic_repo, while the workflow already grantsissues: writeandpull-requests: writeto its native repository token. Using that token removes the broken credential override without broadening the workflow permissions.The latest failed run matched seven comments and minimized none: https://github.com/QwenLM/qwen-code/actions/runs/31778078141
Reviewer Test Plan
How to verify
Confirm the API step authenticates with the repository-scoped token. The focused regression suite should report five passing tests; replacing the token with the shared PAT should fail the credential assertion.
Evidence (Before & After)
N/A — workflow-only change.
Tested on
Environment (optional)
Node.js 22.22.0.
Risk & Scope
Linked Issues
Related to #8767. This PR intentionally isolates only the credential fix needed to restore the current workflow.
中文说明
这个 PR 做了什么
把反垃圾折叠任务从共享机器人 PAT 切换到 workflow 自带的仓库级
GITHUB_TOKEN。同时收紧已有回归护栏,今后如果再次换回权限不足的 PAT,本地测试会直接失败。为什么需要
定时任务能够正确找到黑名单用户的评论,但每次执行
minimizeComment都因INSUFFICIENT_SCOPES失败。共享 PAT 只有public_repo,而 workflow 已经为原生仓库 token 声明了issues: write和pull-requests: write。直接使用原生 token 可以移除错误的凭证覆盖,同时不扩大 workflow 权限。最近一次失败运行命中 7 条评论,实际折叠 0 条:https://github.com/QwenLM/qwen-code/actions/runs/31778078141
复核测试计划
如何验证
确认 API 步骤使用仓库级原生 token。聚焦回归测试应为 5 条全部通过;如果将 token 换回共享 PAT,凭证断言应失败。
证据(前后对比)
N/A —— 仅修改 workflow。
测试环境
Node.js 22.22.0。
风险与范围
关联 Issue
关联 #8767。本 PR 有意只保留恢复当前 workflow 所需的凭证修复。