Skip to content

[quality] provision MEETING_REFRESH_APP_ID/PRIVATE_KEY secrets — refresh PRs still fall back to GITHUB_TOKEN so Vitest/TypeScript never run (#331) #337

Open
Open
[quality] provision MEETING_REFRESH_APP_ID/PRIVATE_KEY secrets — refresh PRs still fall back to GITHUB_TOKEN so Vitest/TypeScript never run (#331)#337
Labels
agent/qualityCreated by Hive for agent-filed issue provenanceneeds-directionqualityCreated by Hive for agent-filed issue provenancestage/085-needs-decisiontestingCreated by Hive for agent-filed issue provenance

Description

@hivecommons-hive
hivecommons-hive
bot
opened on Oct 14, 2026

Finding

test-infrastructure — #296 landed the create-github-app-token step in .github/workflows/meeting-recordings-refresh.yml so the daily refresh PR triggers pull_request workflows, but the repository secrets it reads (MEETING_REFRESH_APP_ID, MEETING_REFRESH_APP_PRIVATE_KEY) were never provisioned. The step is skipped and peter-evans/create-pull-request falls back to GITHUB_TOKEN.

Evidence on #331 (head 0aa1303, author github-actions[bot]): Build, Vitest, TypeScript & Lint Check and npm audit all exist only as action_required runs (https://github.com/hivecommons/docs/actions/runs/38604987727) with no check-run on the head SHA. Since #330 made typecheck/vitest eligible as required checks, every daily refresh PR will now sit BLOCKED until someone manually approves its workflow runs — or, if they are not yet required, merge with data/meeting-recordings.json unvalidated (the failure mode #296 was opened for).

Recommendation

This needs a human with repo admin — no file change can fix it, so no PR accompanies this issue:

  • Create (or reuse) a GitHub App with contents: write + pull_requests: write on hivecommons/docs
  • Add repo secrets MEETING_REFRESH_APP_ID and MEETING_REFRESH_APP_PRIVATE_KEY
  • Trigger Refresh meeting recordings via workflow_dispatch and confirm the new PR is authored by the App bot and shows Build/Vitest/TypeScript check-runs on its head SHA
  • Approve-and-run the pending workflows on docs: refresh community meeting recordings #331 (or close it; the next refresh supersedes it)

Priority

  • Impact: high — required checks never run on an automated daily PR
  • Effort: low — secrets provisioning only

Filed by quality agent (ACMM L4/L6 — full mode)

🐝 Hive Agent: quality | Instance: hosted-available-oke-11-placeholder-r05x | SHA: e10acf9

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

Activity

  1. hivecommons-hive
    added
    qualityCreated by Hive for agent-filed issue provenance
    agent/qualityCreated by Hive for agent-filed issue provenance
    hive/hosted-available-oke-11-placeholder-r05x
    testingCreated by Hive for agent-filed issue provenance
    needs-direction
    on Oct 14, 2026

  2. hivecommons-hive commented on Oct 14, 2026

    @hivecommons-hive
    hivecommons-hivebot
    on Oct 14, 2026 – with hivecommons-hive
    ContributorAuthor

    Scanner triage: this issue cannot be resolved by a code change — the fix is provisioning the MEETING_REFRESH_APP_ID / MEETING_REFRESH_APP_PRIVATE_KEY repository secrets (and a GitHub App with contents: write + pull_requests: write), which needs a repo admin. Labelling needs-direction and leaving it for a maintainer.

    Options:

    • A — provision the App + secrets as listed above, then workflow_dispatch "Refresh meeting recordings" and confirm Build/Vitest/TypeScript check-runs appear on the new PR's head SHA.
    • B — if a dedicated App is not wanted, change .github/workflows/meeting-recordings-refresh.yml to open the PR with a fine-grained PAT stored as a secret (same effect on pull_request triggers); say so and the hive can prepare that workflow PR.
    • C — accept that refresh PRs need manual "Approve and run" each day and close this as working-as-intended.

    Until one is chosen, #331 stays BLOCKED (its workflows are action_required) and is not something the hive can merge.

    🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

    — hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

  3. hivecommons-hive commented on Oct 14, 2026

    @hivecommons-hive
    hivecommons-hivebot
    on Oct 14, 2026 – with hivecommons-hive
    ContributorAuthor

    🔒 Claimed by agent scanner (agent on hive hosted-available-oke-11-placeholder-r05x). The claim lasts 2h0m0s without activity and renews while the work continues. Reply /unclaim to release, or /claim to take it over if you outrank the holder.

  4. hivecommons-hive
    added
    claimed
    hive/in-progress
    on Oct 14, 2026

  5. hivecommons-hive commented on Oct 14, 2026

    @hivecommons-hive
    hivecommons-hivebot
    on Oct 14, 2026 – with hivecommons-hive
    ContributorAuthor

    What to reply

    • /hive approve: go with the recommendation
    • /hive decision <your instructions>: go ahead, following your instructions
    • /hive help: show these again

    If this issue is waiting only for reporter confirmation after a merged fix, the reporter or a maintainer can reply /fixed instead.

    Only a maintainer with write access can un-park; everything else is ignored. Full command reference: https://github.com/hivecommons/hive/blob/v5/src/docs/maintainer-commands.md.

  6. hivecommons-hive
    removed
    claimed
    hive/in-progress
    on Oct 14, 2026

  7. hivecommons-hive commented on Oct 15, 2026

    @hivecommons-hive
    hivecommons-hivebot
    on Oct 15, 2026 – with hivecommons-hive
    ContributorAuthor

    Folded finding. This was filed as a separate issue, but 1 open agent-filed issue (plus 5 closed as completed in the last 14 days) already cite github/workflows/meeting-recordings-refresh.yml, so it was folded into the oldest of them instead of opening another. Treat this issue as the tracker for that component: prefer one structural fix that covers every folded variant over a PR per variant.

    triage: duplicate and overlapping open issues/PRs to consolidate

    Decision required: yes

    Summary

    Triage pass over the 3 open issues and 1 open PR in hivecommons/docs as of 2026-10-15. Found 1 near-duplicate pair, 0 same-root-cause clusters, 0 items already resolved. No actions have been taken; this is a checklist for maintainers.

    Near-duplicates: close one

    Keep Merge into it Reason
    #335 "[ci-maintainer] meeting-recordings-refresh PR #331 blocked: required Lint and build never runs while MEETING_REFRESH_APP_* secrets are unprovisioned" #337 "[quality] provision MEETING_REFRESH_APP_ID/PRIVATE_KEY secrets — refresh PRs still fall back to GITHUB_TOKEN so Vitest/TypeScript never run (#331)" Same finding: both report that the MEETING_REFRESH_APP_ID/MEETING_REFRESH_APP_PRIVATE_KEY secrets from #296/#305 were never provisioned, so the create-github-app-token step in .github/workflows/meeting-recordings-refresh.yml is skipped, peter-evans/create-pull-request falls back to GITHUB_TOKEN, and PR #331's pull_request runs (Build/Vitest/TypeScript & Lint/npm audit) sit action_required with jobs.total_count = 0, leaving #331 permanently blocked. Identical remediation checklist in both (create App with contents: write + pull-requests: write, add the two secrets, re-run via workflow_dispatch). #335 is earlier (10-14 09:29 vs 21:40), already parked needs-decision, and carries the fuller evidence (run IDs 38453838846/38453933859, required-check history from #296).

    Related but distinct: cross-link only

    Checked and not duplicates

    • dibs#375/#376 — same outreach lane, disjoint asks (MCP Registry listing vs. GitHub topics/homepage).
    • promptargs#227 / PR promptargs#228 — PR body already carries Refs #227 (needs-human: Part A …) with the merge-order warning; correctly linked, nothing to add.

    Filed by dedupe agent (issues-only mode). Recommendations only — nothing has been closed, labelled, or merged.

    🐝 Hive Agent: dedupe | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

    — hive: agent=dedupe backend=copilot model=claude-fable-5 copilot=1.0.88

  8. clubanderson commented on Oct 16, 2026

    @clubanderson
    clubanderson
    on Oct 16, 2026
    Member

    Decision menu for this finding is consolidated on #335 (same root cause: MEETING_REFRESH_APP_* secrets unprovisioned; decision A — App token — already recorded on #296, provisioning still pending). Please answer there; this issue should be closed as a duplicate of #335 once the secrets exist and Lint and build appears on #331's head.

    — decision brief prepared for the operator by the hive's maintainer session

  9. hivecommons-hive
    added
    stage/085-needs-decision
    and removed
    hive/hosted-available-oke-11-placeholder-r05x
    on Oct 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    agent/qualityCreated by Hive for agent-filed issue provenanceneeds-directionqualityCreated by Hive for agent-filed issue provenancestage/085-needs-decisiontestingCreated by Hive for agent-filed issue provenance

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions