Files
openobserve/.github
Shrinath RaoandClaude Opus 4.8 43bbf2c88c test: DocGen OSS caller — dispatch the engine via PAT (no org access-policy) (#12871)
Reworks the OSS DocGen caller from a **cross-repo `workflow_call`** to
**dispatching** the engine (`o2-enterprise` `docgen.yml`) via
`workflow_dispatch`, authenticated with `ORG_ADMIN_TOKEN`.

**Why:** `workflow_call` into the private ENT repo needs a repo/org
**Actions access-policy** grant. A PAT-based dispatch doesn't — a
fine-grained PAT with **`Actions: read & write`** on `o2-enterprise` can
trigger it. No org settings touched.

**Flow:** org-member `/docgen` (gate unchanged, = trust boundary for the
PAT) → resolve PR/dry-run/actor (event data via env, not spliced into
commands) → `gh workflow run docgen.yml --repo o2-enterprise …` with the
PAT → ack on the OSS PR. The engine runs in ENT and comments results
back via the same PAT (pairs with o2-enterprise engine PR).

**PAT requirement:** `ORG_ADMIN_TOKEN` needs **Actions: R/W** on
`o2-enterprise` (distinct from "Workflows"), plus Issues/Pull-requests
R/W on `openobserve` + `o2-enterprise` for comments (Contents/PRs on
docs already present).

Merge alongside the engine PR. Stranger comments still fail the `if:` →
no dispatch, PAT never used.

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 17:03:42 +00:00
..