[Pigbibi]

AI assistance

Written by Grok Bot (AI assistant); an independent review happens before merge.

What changed

The bump job in .github/workflows/fee-schedule-check.yml (added in #502) now opens its pull
request with a GitHub App installation token instead of GITHUB_TOKEN:

• New step actions/create-github-app-token pinned to bcd2ba49218906704ab6c1aa796996da409d3eb1
  (v3.2.0). app-id is the repository variable vars.FIRSTRADE_PR_APP_ID (the action's app-id input still
  works), the private key is secrets.FIRSTRADE_PR_APP_PRIVATE_KEY, owner is the repository owner, repositories is
  FirstradePlatform, and only permission-contents: write and permission-pull-requests: write
  are requested.
• The step runs only when the non-secret job env flag APP_CONFIGURED is true (the variable and the secret
  are both non-empty; secrets cannot be tested directly in if:). It is continue-on-error.
• The App token is used only for the branch push and gh pr create, so CI starts on the PR like on
  any other. Everything else keeps GITHUB_TOKEN. The token is never echoed (the action masks it).
• Fallback: if the variable or secret is empty or token creation fails, the job behaves as before. It pushes
  the branch with GITHUB_TOKEN, PR creation fails, and notify opens or updates the issue with a
  compare link. A failed App push also retries with GITHUB_TOKEN.
• Job permissions are unchanged (contents: write, pull-requests: write); they are still needed
  for the fallback.
• The PR body note about "close and reopen to run CI" now appears only in the fallback case.
• docs/statement-reconciliation.md and the zh-CN doc describe the App: qsl-qpk-pin-sync (ID
  5004823), already installed on this repository with contents and pull-requests write. The setup
  is the repository variable FIRSTRADE_PR_APP_ID and the repository secret
  FIRSTRADE_PR_APP_PRIVATE_KEY. The qsl-cross-repo-automation and organization secret
  mentions are removed.

The repository setting "Allow GitHub Actions to create and approve pull requests" stays off. No new
secrets or keys are added. No test covers the workflow structure, so no test changed.

How verified

• actionlint .github/workflows/fee-schedule-check.yml passes (on the previous head; this update
  only renames the variable and secret and was checked as valid YAML and by CI).
• pytest tests/test_check_fee_schedule.py: 35 passed.
• scripts/check_style.py --phase 2 and scripts/test_style.py pass (one pre-existing advisory
  about the README outline).
• Not run: the App path itself. It needs the repository variable and secret to exist. Until then the fallback path
  applies. This PR triggers the check job
  only (the bump job is limited to main).

Why

#502 could not open the bump PR because the repository setting for Actions-created PRs is off, and
PRs from GITHUB_TOKEN do not start CI. An App token avoids both without enabling that setting.

Risk

Low. Only the monthly bump job changes, and only when the App secrets exist. The token is limited to
this repository with contents and pull-requests write and expires after the job. Pinned action SHA.
Worst case is the previous fallback behaviour (branch plus issue). Takes effect once the repository
variable FIRSTRADE_PR_APP_ID and secret FIRSTRADE_PR_APP_PRIVATE_KEY exist.

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: d6330775-660c-4e0b-b0dc-22eec66a6a51

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn