do it

Author: bmastbergen

.github/workflows/clk-rebase.yml

@@ -63,24 +63,6 @@ jobs:
           # with --allowerasing
           dnf install curl --allowerasing -y
 
-      - name: Check if token can push
-        run: |
-          REPO_PERMS=$(curl -s -H "Authorization: Bearer ${{ steps.generate-token.outputs.token }}" \
-            -H "Accept: application/vnd.github+json" \
-            "https://api.github.com/repos/${{ github.repository }}" \
-            | jq -r '.permissions')
-          
-          PUSH_ALLOWED=$(echo "$REPO_PERMS" | jq -r '.push')
-          
-          if [ "$PUSH_ALLOWED" == "true" ]; then
-            echo "✓ Token has push permissions"
-          else
-            echo "✗ Token does NOT have push permissions. Full permissions object: $REPO_PERMS"
-            #exit 1
-          fi
-
-      
-
       - name: Checkout kernel-src-tree
         uses: actions/checkout@v4
         with:
@@ -112,9 +94,6 @@ jobs:
 
           ../kernel-src-tree-tools/lt_rebase.sh $STABLE_TRACKING_BRANCH
 
-          # HACK HACK HACK do this early for testing
-          git push origin $CLK_NEXT_BRANCH
-          git push origin $TMP_CLK_NEXT_BRANCH
       - name: Build kernel
         run: |
           cd kernel-src-tree
@@ -163,7 +142,19 @@ jobs:
 
           vng --qemu /usr/libexec/qemu-kvm --force-initramfs --disable-microvm --rw --network user --verbose --memory 16G -- ../kernel-src-tree-tools/kernel_kselftest.sh
 
+      - name: Generate fresh token for push and PR
+        id: generate-push-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          repositories: |
+            kernel-src-tree
+            kernel-src-tree-tools
+
       - name: Extract results and push branches
+        env:
+          PUSH_TOKEN: ${{ steps.generate-push-token.outputs.token }}
         run: |
           cd kernel-src-tree
 
@@ -175,6 +166,9 @@ jobs:
           STABLE_VERSION=$(git log -1 --format=%s $STABLE_TRACKING_BRANCH | grep -oP 'Linux \K[0-9]+\.[0-9]+\.[0-9]+' || echo "unknown")
           echo "Rebased to stable version: $STABLE_VERSION"
 
+          # Authenticate with the fresh token
+          git remote set-url origin "https://x-access-token:${PUSH_TOKEN}@github.com/${{ github.repository }}"
+
           # Push the branches
           git push origin $CLK_NEXT_BRANCH
           git push origin $TMP_CLK_NEXT_BRANCH
@@ -215,7 +209,7 @@ jobs:
       - name: Fetch previous PR kselftest results
         if: success()
         env:
-          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
+          GH_TOKEN: ${{ steps.generate-push-token.outputs.token }}
         run: |
           cd kernel-src-tree
 
@@ -230,7 +224,7 @@ jobs:
             --state merged \
             --limit 10 \
             --json number,title,body,mergedAt \
-            --jq "map(select(.title | contains(\"[CIQ ${CLK_VERSION}]\"))) | sort_by(.mergedAt) | reverse | .[0]")
+            --jq "map(select(.title | contains(\"[CIQ ${CLK_VERSION}\"]))) | sort_by(.mergedAt) | reverse | .[0]")
 
           if [ -n "$PREVIOUS_PR" ] && [ "$PREVIOUS_PR" != "null" ]; then
             # Extract the test count from the previous PR body
@@ -250,7 +244,7 @@ jobs:
       - name: Create Pull Request
         if: success()
         env:
-          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
+          GH_TOKEN: ${{ steps.generate-push-token.outputs.token }}
         run: |
           cd kernel-src-tree