W2 Atomization Workflow Cannot Reset Integration Branch

[aRustyDev]

Description

The W2 atomization workflow (atomize-integration-pr.yaml) fails when attempting to reset the integration branch to main after atomization completes.

Error

remote: error: GH013: Repository rule violations found for refs/heads/integration.
remote: - Changes must be made through a pull request.
remote: - Cannot force-push to this branch

Root Cause

1. The protected-branches-linear ruleset includes a non_fast_forward rule that prevents force pushes
2. The workflow uses github.token which does not have admin bypass privileges
3. Even though admin bypass is now configured on the ruleset, github.token cannot utilize it

Impact

• E2E-1 (Happy Path) test: W1 validation passes but W2 atomization fails
• The atomization pipeline is blocked at the reset step
• Manual intervention required to reset integration branch

Proposed Solution

Update the workflow to use a Personal Access Token (PAT) with admin privileges:

1. Create a PAT with repo scope and admin access
2. Store the PAT as a repository secret (e.g., ADMIN_TOKEN)
3. Update the Reset Integration step in atomize-integration-pr.yaml:

- name: Reset integration to main
  env:
    GH_TOKEN: ${{ secrets.ADMIN_TOKEN }}  # Changed from github.token
  run: |
    git checkout integration
    git reset --hard origin/main
    git push origin integration --force-with-lease

Related

• Ruleset: protected-branches-linear (ID: 11925113)
• Workflow: .github/workflows/atomize-integration-pr.yaml
• Documentation: docs/src/troubleshooting/ci-known-issues.md
• ADR: ADR-011 (Full Atomization Model)

Workaround

Admins can manually reset the integration branch:

git checkout integration
git reset --hard origin/main
git push --force-with-lease origin integration

[aRustyDev]

Update: Solution Implemented

The workflow has been updated to use GitHub App authentication:

Changes Made

1. Ruleset reconfiguration:

   • Removed integration from protected-branches-linear (which has non_fast_forward)
   • Created new integration-linear-history ruleset (without non_fast_forward)

2. Workflow updated (atomize-integration-pr.yaml):

   • Added generate-token job using actions/create-github-app-token@v1
   • All jobs now use the app token instead of github.token
   • Reset step uses authenticated push via app token

Required Action

To complete the fix, you need to:

1. Add repository secrets:

   • APP_ID: Your GitHub App ID
   • APP_PRIVATE_KEY: Your GitHub App private key

2. Add GitHub App as bypass actor via UI:

   • Settings > Rules > Rulesets > integration-pr-required
   • Bypass list > Add bypass > Select your GitHub App

Once secrets are configured, the workflow should be able to reset the integration branch.

---

Documentation updated: docs/src/troubleshooting/ci-known-issues.md