Our recipes checker workflow is not running code from the checkout out codebase (it runs the recipes-checker tool fetched separately) so allowing the checkout is OK.
The previous attempt still failed:
- The Flex push embedded the token in the URL, but actions/checkout had
persisted an http.<host>.extraheader Authorization for the default
GITHUB_TOKEN, which git sends in preference to the URL credentials —
so the push authenticated as github-actions[bot] and got 403. Unset
that header before pushing so the BOT_TOKEN in the URL is used.
- marocchino/sticky-pull-request-comment reads the token from its
GITHUB_TOKEN input (default github.token), not the env var, so the
read-only default token was still used. Pass it via "with:" instead.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The default GITHUB_TOKEN is now read-only, so pushing the generated Flex
endpoint and posting the recipe-diff comment failed (403 / "Resource not
accessible by integration"). Authenticate both via the BOT_TOKEN without
persisting it into the checkout credentials.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* main:
Adding a new callable recipes readme GH action
Always run "Setup PHP" steps
Clean CI config
Enable Automerge
Specify license for recipes-checker-main lint:pull-request
Test recipes on Symfony 5&6
Fix escaping args in commands
Fix linting JSON files
Hit raw.githubusercontent.com to work around rate limiting
Add callable action to repopulate the recipe archives
Copying the "archived/" directory from recipes-checker
Add reusable workflows
Christophe CoevoetandGitHub
Fabien Potencier
Nicolas GrekasandClaude Opus 4.8
Jan RosierandGitHub
Oskar Stark
Illia Antypenko
Ryan Weaver
Ilya AntipenkoandNicolas Grekas
Ryan WeaverandGitHub