From 445916dbeb585269f94e3fd920b51b5cfbe80039 Mon Sep 17 00:00:00 2001 From: berringtoni36-commits Date: Mon, 31 Aug 2026 22:12:31 +0800 Subject: [PATCH] Update CI overview with Crossbow token maintenance info Added details about maintaining the Crossbow GitHub token and its required scopes. --- .../continuous_integration/overview.rst | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/docs/source/developers/continuous_integration/overview.rst b/docs/source/developers/continuous_integration/overview.rst index 71bc53ef59a7..20a0539bdf40 100644 --- a/docs/source/developers/continuous_integration/overview.rst +++ b/docs/source/developers/continuous_integration/overview.rst @@ -55,6 +55,22 @@ The ``.yml`` files in ``.github/workflows`` are workflows which are run on GitHu - ``dev.yml`` - runs any time there is activity on a PR, or a PR is merged; it runs the linter and tests that the PR can be merged - ``dev_pr.yml`` - runs any time a PR is opened or updated; checks the formatting of the PR title, adds assignee to the appropriate GitHub issue if needed (or adds a comment requesting the user to include the issue id in the title), and adds any relevant GitHub labels +Maintaining the Crossbow GitHub token +------------------------------------- + +The ``comment_bot.yml`` workflow uses ``CROSSBOW_GITHUB_TOKEN`` when it +submits Crossbow jobs from pull-request comments. The token must have the +following GitHub scopes: + +- ``contents:write`` +- ``actions:write`` +- ``workflows:write`` + +When the token-expiration notification is received, generate a replacement +token with these scopes and send it to Apache INFRA. INFRA updates the +``CROSSBOW_GITHUB_TOKEN`` Actions secret. The replacement also needs to be +updated in the Crossbow repository and in the Azure Pipelines configuration. + Extended builds -----------------------