From fefe6420a7f6774fdeb739ed3d2638f230f1439b Mon Sep 17 00:00:00 2001 From: Matt Miller Date: Tue, 28 Jul 2026 14:47:08 -0700 Subject: [PATCH] ci: use cloud-code-bot for the dispatch token FEN_RELEASE_* are environment secrets on the 'backport release' environment, which is gated on required reviewers. A tag dispatch must not wait on a human approval, so that environment is not usable here. cloud-code-bot already authors the bump PRs on the cloud side, so its write access to Comfy-Org/cloud is established. --- .github/workflows/tag-dispatch-cloud.yml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/workflows/tag-dispatch-cloud.yml b/.github/workflows/tag-dispatch-cloud.yml index 84c529441..e446ee4cf 100644 --- a/.github/workflows/tag-dispatch-cloud.yml +++ b/.github/workflows/tag-dispatch-cloud.yml @@ -22,10 +22,14 @@ jobs: id: app-token uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 with: - app-id: ${{ secrets.FEN_RELEASE_APP_ID }} - private-key: ${{ secrets.FEN_RELEASE_PRIVATE_KEY }} - # Cross-repo dispatch: without these the token is scoped to this - # repository and the POST to cloud would 403. + # cloud-code-bot is the same App the cloud receiver already runs on: + # it authored the bump PRs, so its write access there is established + # rather than assumed. + app-id: ${{ vars.CLOUD_CODE_BOT_APP_ID }} + private-key: ${{ secrets.CLOUD_CODE_BOT_PRIVATE_KEY }} + # Cross-repo dispatch: create-github-app-token scopes to the current + # repository by default, so the org installation must be named + # explicitly or the POST to cloud would 403. owner: Comfy-Org repositories: cloud