From 84e7defe4342cb427e3b1b5fc35df501c6cc58eb Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 19 Aug 2026 11:48:41 +0000 Subject: [PATCH 1/4] Initial plan From 7c132a62998ee6bf3ddeab1e1d89ca9a45f77fc9 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 19 Aug 2026 11:50:25 +0000 Subject: [PATCH 2/4] Use PYBATFISH_GITHUB_TOKEN PAT for cross-repo push to batfish/pybatfish Co-authored-by: dhalperi <526415+dhalperi@users.noreply.github.com> --- .github/workflows/cross_version_test.yml | 2 ++ .github/workflows/reusable-upload.yml | 4 +++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/cross_version_test.yml b/.github/workflows/cross_version_test.yml index 1c27a56..be91436 100644 --- a/.github/workflows/cross_version_test.yml +++ b/.github/workflows/cross_version_test.yml @@ -64,6 +64,7 @@ jobs: PYBATFISH_TEST_PYPI_TOKEN: ${{ secrets.PYBATFISH_TEST_PYPI_TOKEN }} PYBATFISH_PYPI_TOKEN: ${{ secrets.PYBATFISH_PYPI_TOKEN }} BATFISH_DOCKER_LOGIN_TOKEN: ${{ secrets.BATFISH_DOCKER_LOGIN_TOKEN }} + PYBATFISH_GITHUB_TOKEN: ${{ secrets.PYBATFISH_GITHUB_TOKEN }} # Validate the uploaded test artifacts with lab-validation lab_validation: @@ -98,6 +99,7 @@ jobs: PYBATFISH_TEST_PYPI_TOKEN: ${{ secrets.PYBATFISH_TEST_PYPI_TOKEN }} PYBATFISH_PYPI_TOKEN: ${{ secrets.PYBATFISH_PYPI_TOKEN }} BATFISH_DOCKER_LOGIN_TOKEN: ${{ secrets.BATFISH_DOCKER_LOGIN_TOKEN }} + PYBATFISH_GITHUB_TOKEN: ${{ secrets.PYBATFISH_GITHUB_TOKEN }} # Send Slack notification on failure for scheduled or post-merge jobs on master branch notify_slack_on_failure: diff --git a/.github/workflows/reusable-upload.yml b/.github/workflows/reusable-upload.yml index 67c8381..407c9f3 100644 --- a/.github/workflows/reusable-upload.yml +++ b/.github/workflows/reusable-upload.yml @@ -37,6 +37,8 @@ on: required: true BATFISH_DOCKER_LOGIN_TOKEN: required: true + PYBATFISH_GITHUB_TOKEN: + required: true env: BATFISH_DOCKER_LOGIN_USERNAME: batfishbuildkitebot @@ -252,7 +254,7 @@ jobs: repository: "${{ inputs.BATFISH_GITHUB_PYBATFISH_REPO }}" path: pybatfish ref: "${{ inputs.BATFISH_GITHUB_PYBATFISH_REF }}" - token: ${{ github.token }} + token: ${{ secrets.PYBATFISH_GITHUB_TOKEN }} - name: Push test branch run: | cd pybatfish From a3e293b3f0d6d8d2730cccb5fd538a3bf0ece15d Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 19 Aug 2026 12:02:15 +0000 Subject: [PATCH 3/4] Use SSH deploy key for pushing pybatfish release branch Co-authored-by: dhalperi <526415+dhalperi@users.noreply.github.com> --- .github/workflows/cross_version_test.yml | 4 ++-- .github/workflows/reusable-upload.yml | 14 ++++++++++---- 2 files changed, 12 insertions(+), 6 deletions(-) diff --git a/.github/workflows/cross_version_test.yml b/.github/workflows/cross_version_test.yml index be91436..5a8ef0d 100644 --- a/.github/workflows/cross_version_test.yml +++ b/.github/workflows/cross_version_test.yml @@ -64,7 +64,7 @@ jobs: PYBATFISH_TEST_PYPI_TOKEN: ${{ secrets.PYBATFISH_TEST_PYPI_TOKEN }} PYBATFISH_PYPI_TOKEN: ${{ secrets.PYBATFISH_PYPI_TOKEN }} BATFISH_DOCKER_LOGIN_TOKEN: ${{ secrets.BATFISH_DOCKER_LOGIN_TOKEN }} - PYBATFISH_GITHUB_TOKEN: ${{ secrets.PYBATFISH_GITHUB_TOKEN }} + PYBATFISH_DEPLOY_KEY_FOR_PUSHING_RELEASE_BRANCH: ${{ secrets.PYBATFISH_DEPLOY_KEY_FOR_PUSHING_RELEASE_BRANCH }} # Validate the uploaded test artifacts with lab-validation lab_validation: @@ -99,7 +99,7 @@ jobs: PYBATFISH_TEST_PYPI_TOKEN: ${{ secrets.PYBATFISH_TEST_PYPI_TOKEN }} PYBATFISH_PYPI_TOKEN: ${{ secrets.PYBATFISH_PYPI_TOKEN }} BATFISH_DOCKER_LOGIN_TOKEN: ${{ secrets.BATFISH_DOCKER_LOGIN_TOKEN }} - PYBATFISH_GITHUB_TOKEN: ${{ secrets.PYBATFISH_GITHUB_TOKEN }} + PYBATFISH_DEPLOY_KEY_FOR_PUSHING_RELEASE_BRANCH: ${{ secrets.PYBATFISH_DEPLOY_KEY_FOR_PUSHING_RELEASE_BRANCH }} # Send Slack notification on failure for scheduled or post-merge jobs on master branch notify_slack_on_failure: diff --git a/.github/workflows/reusable-upload.yml b/.github/workflows/reusable-upload.yml index 407c9f3..feb1c13 100644 --- a/.github/workflows/reusable-upload.yml +++ b/.github/workflows/reusable-upload.yml @@ -37,7 +37,7 @@ on: required: true BATFISH_DOCKER_LOGIN_TOKEN: required: true - PYBATFISH_GITHUB_TOKEN: + PYBATFISH_DEPLOY_KEY_FOR_PUSHING_RELEASE_BRANCH: required: true env: @@ -236,8 +236,6 @@ jobs: prod_whl_upload: if: inputs.queue_prod_release && inputs.BATFISH_GITHUB_BATFISH_REPO == 'batfish/batfish' && inputs.BATFISH_GITHUB_PYBATFISH_REPO == 'batfish/pybatfish' environment: Release Pybatfish - permissions: - contents: write runs-on: ubuntu-latest steps: - name: Download pybf whl @@ -248,14 +246,22 @@ jobs: run: | mkdir dist mv pybatfish*.whl dist/ + - name: Configure SSH for pybatfish deploy key + run: | + mkdir -p ~/.ssh + echo "${{ secrets.PYBATFISH_DEPLOY_KEY_FOR_PUSHING_RELEASE_BRANCH }}" > ~/.ssh/pybatfish_deploy_key + chmod 600 ~/.ssh/pybatfish_deploy_key + ssh-keyscan github.com >> ~/.ssh/known_hosts - name: Checkout pybf repo uses: actions/checkout@v7 with: repository: "${{ inputs.BATFISH_GITHUB_PYBATFISH_REPO }}" path: pybatfish ref: "${{ inputs.BATFISH_GITHUB_PYBATFISH_REF }}" - token: ${{ secrets.PYBATFISH_GITHUB_TOKEN }} + ssh-key: ${{ secrets.PYBATFISH_DEPLOY_KEY_FOR_PUSHING_RELEASE_BRANCH }} - name: Push test branch + env: + GIT_SSH_COMMAND: "ssh -i ~/.ssh/pybatfish_deploy_key -o IdentitiesOnly=yes" run: | cd pybatfish sed -i.bak -e "s/^__version__ = .*$/__version__ = \"${{ inputs.bf_version }}\"/" pybatfish/__init__.py From 5e51f25c77e6b274be024885f50b7bb0e630573c Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 19 Aug 2026 12:14:28 +0000 Subject: [PATCH 4/4] Mark PYBATFISH_DEPLOY_KEY_FOR_PUSHING_RELEASE_BRANCH as required: false Co-authored-by: dhalperi <526415+dhalperi@users.noreply.github.com> --- .github/workflows/reusable-upload.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/reusable-upload.yml b/.github/workflows/reusable-upload.yml index feb1c13..bd15ae2 100644 --- a/.github/workflows/reusable-upload.yml +++ b/.github/workflows/reusable-upload.yml @@ -38,7 +38,7 @@ on: BATFISH_DOCKER_LOGIN_TOKEN: required: true PYBATFISH_DEPLOY_KEY_FOR_PUSHING_RELEASE_BRANCH: - required: true + required: false # only used by prod_whl_upload, which only runs when queue_prod_release is true env: BATFISH_DOCKER_LOGIN_USERNAME: batfishbuildkitebot