From ddb5304bc37b53ffeba5557a214f361d6c8a22f0 Mon Sep 17 00:00:00 2001 From: Joshua Li Date: Tue, 25 Aug 2026 18:51:16 -0700 Subject: [PATCH 1/4] chore(gocd): use GitHub App credentials --- gocd/pipelines/reload.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/gocd/pipelines/reload.yaml b/gocd/pipelines/reload.yaml index 385b677..7f8ecb6 100644 --- a/gocd/pipelines/reload.yaml +++ b/gocd/pipelines/reload.yaml @@ -26,7 +26,8 @@ pipelines: checks: environment_variables: # Required for checkruns. - GITHUB_TOKEN: "{{SECRET:[devinfra-github][token]}}" + GITHUB_APP_ID: "{{SECRET:[devinfra-github][app_id]}}" + GITHUB_APP_PRIVATE_KEY: "{{SECRET:[devinfra-github][private_key]}}" timeout: 1200 elastic_profile_id: reload tasks: From b4e338d7e539f4230cbc85b01c4130d4e9151ab6 Mon Sep 17 00:00:00 2001 From: Joshua Li Date: Thu, 27 Aug 2026 10:38:39 -0700 Subject: [PATCH 2/4] use checkruns2 for GitHub App credentials --- gocd/pipelines/reload.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gocd/pipelines/reload.yaml b/gocd/pipelines/reload.yaml index 7f8ecb6..9831c2c 100644 --- a/gocd/pipelines/reload.yaml +++ b/gocd/pipelines/reload.yaml @@ -32,7 +32,7 @@ pipelines: elastic_profile_id: reload tasks: - script: | - checks-githubactions-checkruns \ + checks-githubactions-checkruns2 \ getsentry/reload \ ${GO_REVISION_RELOAD_REPO} \ "Build and push production image" From 7ed4ec1ece07edc4253467679f5ea20f8a642b3d Mon Sep 17 00:00:00 2001 From: Joshua Li Date: Thu, 27 Aug 2026 10:40:47 -0700 Subject: [PATCH 3/4] clarify checkruns2 App credential usage --- gocd/pipelines/reload.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gocd/pipelines/reload.yaml b/gocd/pipelines/reload.yaml index 9831c2c..158b194 100644 --- a/gocd/pipelines/reload.yaml +++ b/gocd/pipelines/reload.yaml @@ -25,7 +25,7 @@ pipelines: jobs: checks: environment_variables: - # Required for checkruns. + # Required for checkruns2. GITHUB_APP_ID: "{{SECRET:[devinfra-github][app_id]}}" GITHUB_APP_PRIVATE_KEY: "{{SECRET:[devinfra-github][private_key]}}" timeout: 1200 From 501d7482559e6659e1707d062be6136bde12c518 Mon Sep 17 00:00:00 2001 From: Joshua Li Date: Tue, 6 Oct 2026 12:11:14 -0700 Subject: [PATCH 4/4] Run image build on pull requests --- .github/workflows/image.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/image.yml b/.github/workflows/image.yml index 4076cf8..7370420 100644 --- a/.github/workflows/image.yml +++ b/.github/workflows/image.yml @@ -9,7 +9,7 @@ on: jobs: build-production: runs-on: ubuntu-24.04 - if: github.ref_name == github.event.repository.default_branch + if: github.event_name == 'pull_request' || github.ref_name == github.event.repository.default_branch name: Build and push production image permissions: contents: read