[react-sync] Open pull requests as the bot that authors the commits - #96682
Merged
Conversation
The React sync used two GitHub identities. `RELEASE_GITHUB_TOKEN`, an installation token for the `next-js-bot` GitHub App, created the signed commits and the branch ref, while `GITHUB_TOKEN` was wired to the `GH_TOKEN_PULL_REQUESTS` personal access token and backed the `Octokit` instance that opened the pull request, enabled auto-merge, and applied the assignee, reviewers, and labels. Every sync pull request therefore showed commits authored by `next-js-bot[bot]` next to a pull request opened by `vercel-release-bot`. The `Octokit` instance is now built from `releaseGithubToken`, so the pull request comes from the same identity that authors the commits. The `create-github-app-token` step also requests `permission-pull-requests: write`, which the app already holds and which has to be listed explicitly because the action narrows the installation token to exactly the permissions requested. `GITHUB_TOKEN` goes back to the single job its own comment describes, authenticating the `facebook/react` compare request that builds the changelog so it does not hit anonymous rate limits. The workflow passes the built-in `secrets.GITHUB_TOKEN` for that instead of `GH_TOKEN_PULL_REQUESTS`, and the guard that required `GITHUB_TOKEN` whenever `--create-pull` was passed is removed. The job gained an explicit `contents: read` permission block, since reading a public repository is all the built-in token is still used for. One consequence is that `author_association` on sync pull requests changes from `MEMBER` to `NONE`, because GitHub App bots are not organization members. The only workflow keyed on that value is `automated_code_review.yml`, which has never produced a run on an `update/react*` branch.
Contributor
Tests PassedCommit: f2784e4 |
Contributor
Stats from current PR🔴 3 regressions
📊 All Metrics📖 Metrics GlossaryDev Server Metrics:
Build Metrics:
Change Thresholds:
⚡ Dev Server
📦 Dev Server (Webpack) (Legacy)📦 Dev Server (Webpack)
⚡ Production Builds
📦 Production Builds (Webpack) (Legacy)📦 Production Builds (Webpack)
📦 Bundle SizesBundle Sizes⚡ TurbopackClient Main Bundles
Server Middleware
Build DetailsBuild Manifests
Build Cache
📦 WebpackClient Main Bundles
Polyfills
Pages
Server Edge SSR
Middleware
Build DetailsBuild Manifests
Build Cache
🔄 Shared (bundler-independent)Runtimes
📎 Tarball URLCommit: f2784e4 |
eps1lon
changed the title
eps1lon
marked this pull request as ready for review
August 4, 2026 22:02
ztanner
approved these changes
Aug 5, 2026
m-kawafuji
pushed a commit
to m-kawafuji/next.js
that referenced
this pull request
Aug 8, 2026
…ercel#96682) Noticed when auto-merge didn't work. `vercel-release-bot` isn't in the exemption list (for good reason). Since `vercel-release-bot` still uses a static token, it's time to use the app fully. The rest of the usage I'll do in a follow-up. ## test plan It'll fail for now when enabling auto-merge. Everything else works though. I'll fix the perms for auto-merge in a follow-up. - [x] [sync from this branch](https://github.com/vercel/next.js/actions/runs/30954178134/job/92143210455) -> vercel#96688
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Noticed when auto-merge didn't work.
vercel-release-botisn't in the exemption list (for good reason).Since
vercel-release-botstill uses a static token, it's time to use the app fully.The rest of the usage I'll do in a follow-up.
test plan
It'll fail for now when enabling auto-merge. Everything else works though. I'll fix the perms for auto-merge in a follow-up.
cbb046ab-20260731to7dfc7ccd-20260803#96688