fix(live-tests): use the admin token for the test-search smoke test - #1796
Open
jd wants to merge 1 commit into
Open
fix(live-tests): use the admin token for the test-search smoke test#1796jd wants to merge 1 commit into
jd wants to merge 1 commit into
Conversation
`tests_show_no_match` has failed on every pull request in this repo
since 2026-09-03, with a 403 on
`GET /v1/ci/{owner}/repositories/{repo}/search/tests`. Nothing in
this repo caused it and nothing here can be blamed for it: the
last green run was 2026-09-02 13:27Z, and
Mergifyio/monorepo#39768 — "cut the ci application key down to
least privilege" — merged 2026-09-03 08:40Z.
That change dropped `search/tests` from the `ci` application key's
scope on purpose. `mergify tests show` is an interactive developer
command, run from a laptop by someone with their own credential;
it is not work an unattended CI job does, so a token that sits in
CI config should not reach it. The endpoint's `security` in the
public OpenAPI is now `AdminApplicationKey`, `MergifyTokenBearerAuth`
and `GitHubTokenBearerAuth` — no `ApplicationKey`. The 403 is the
product working.
So the test is wrong, not the API: it passes
`LIVE_TEST_MERGIFY_TOKEN_CI` at an endpoint the CI key is
deliberately barred from. Switch it to
`LIVE_TEST_MERGIFY_TOKEN_ADMIN`, which is the admin application
key the queue-admin and freeze tests already use and which the
endpoint still accepts, and widen the comments on
`live_admin_token` and in the workflow so the next reader knows
the split is about what a CI token may reach, not about
merge-queue endpoints specifically.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018bo8M8rLudvf22poAaxLfY
Change-Id: I5a1fe7dbbfb021d25ba7f3e1bc76108e37ac3f09
Member
Author
|
This pull request is part of a Mergify stack:
|
Contributor
Merge Protections🔴 2 of 6 protections blocking · waiting on 👀 reviews
🔴 👀 Review RequirementsWaiting for
This rule is failing.
🔴 🔎 ReviewsWaiting for
This rule is failing.
Show 4 satisfied protections🟢 🤖 Continuous Integration
🟢 Enforce conventional commitMake sure that we follow https://www.conventionalcommits.org/en/v1.0.0/
🟢 📕 PR description
🟢 🚦 Auto-queueWhen all merge protections are satisfied, this pull request will be queued automatically. |
There was a problem hiding this comment.
🟢 Approval recommended
The change is narrowly scoped to using the correct token for an endpoint that no longer accepts the CI application key, with matching documentation updates.
Pull request overview
Updates the live functional smoke tests for the mergify Rust CLI to use the admin application key for the tests show “test-search” endpoint, matching the API’s updated authorization model (403 for the CI-scoped key is now expected behavior).
Changes:
- Switch
tests_show_no_matchto authenticate withLIVE_TEST_MERGIFY_TOKEN_ADMINinstead of the CI-scoped token. - Clarify in-code and workflow comments that the token split is about least-privilege scoping (CI token vs admin-required endpoints), including
tests show.
File summaries
| File | Description |
|---|---|
| crates/mergify-cli/tests/live_smoke.rs | Uses live_admin_token() for the tests show smoke test and expands rationale comments. |
| .github/workflows/func-tests-live.yaml | Updates workflow comments to document that tests show uses the admin token alongside other admin-scoped endpoints. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
jd
marked this pull request as ready for review
September 4, 2026 13:43
sileht
approved these changes
Sep 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
tests_show_no_matchhas failed on every pull request in this reposince 2026-09-03, with a 403 on
GET /v1/ci/{owner}/repositories/{repo}/search/tests. Nothing inthis repo caused it and nothing here can be blamed for it: the
last green run was 2026-09-02 13:27Z, and
Mergifyio/monorepo#39768 — "cut the ci application key down to
least privilege" — merged 2026-09-03 08:40Z.
That change dropped
search/testsfrom theciapplication key'sscope on purpose.
mergify tests showis an interactive developercommand, run from a laptop by someone with their own credential;
it is not work an unattended CI job does, so a token that sits in
CI config should not reach it. The endpoint's
securityin thepublic OpenAPI is now
AdminApplicationKey,MergifyTokenBearerAuthand
GitHubTokenBearerAuth— noApplicationKey. The 403 is theproduct working.
So the test is wrong, not the API: it passes
LIVE_TEST_MERGIFY_TOKEN_CIat an endpoint the CI key isdeliberately barred from. Switch it to
LIVE_TEST_MERGIFY_TOKEN_ADMIN, which is the admin applicationkey the queue-admin and freeze tests already use and which the
endpoint still accepts, and widen the comments on
live_admin_tokenand in the workflow so the next reader knowsthe split is about what a CI token may reach, not about
merge-queue endpoints specifically.
Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_018bo8M8rLudvf22poAaxLfY