fix(DOPS-12542): inline the auto-approve bridge (public repo can't call internal reusable) - #77
Merged
Merged
Conversation
…ll internal reusable) The stub called a reusable workflow in CheckPointSW/.github (internal). GitHub forbids a PUBLIC repo from calling a reusable workflow in a private/internal repo, so the Lambda's workflow_dispatch failed with 422 ... called workflow ... was not found (an access error, not a missing file). Inline the full bridge body (verify head sha + pinned validator-App check -> enable auto-merge -> approve as github-actions[bot]) into this workflow. Runs on checkpointsw-scaleset; dispatch-only + default-branch guard keep untrusted PR code off the self-hosted runner. Reads AUTO_APPROVER_APP_ID from the org secret directly (no secrets: inherit needed without the reusable call).
AUTO_APPROVER_APP_ID (4287270) is a public identifier, not a secret. Inline it as APPROVER_APP_ID: "4287270" — drops the org-secret-visibility prerequisite for public repos.
chkp-adirb
approved these changes
Aug 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The bridge stub called a reusable workflow in
CheckPointSW/.github(internal). GitHub forbids a public repo from calling a reusable workflow in a private/internal repo, so the validator Lambda'sworkflow_dispatchfailed:(an access error — the internal repo's "Access" setting only shares with private/internal callers, never public ones).
What
Inline the full bridge body into this workflow (no reusable
uses:):verify head sha + pinned validator-App success check → enable auto-merge (queue) → approve as
github-actions[bot](write access → the approval counts).runs-on: checkpointsw-scaleset(no GitHub-hosted runners here). Dispatch-only +if: github.ref_name == default_branchguard keep untrusted PR code off the self-hosted runner.AUTO_APPROVER_APP_IDfrom the org secret directly (nosecrets: inheritneeded without the reusable call).Depends on (admin)
AUTO_APPROVER_APP_IDvisible to this public repo.checkpointsw-scalesetrunner group permits this repo.allow_auto_mergeON + "Allow GitHub Actions to create and approve pull requests" ON.Generated by the updated onboarding scaffold (
STUB_TEMPLATE).