mirror of
https://github.com/openobserve/openobserve.git
synced 2026-11-04 16:09:05 +00:00
Reworks the OSS DocGen caller from a **cross-repo `workflow_call`** to **dispatching** the engine (`o2-enterprise` `docgen.yml`) via `workflow_dispatch`, authenticated with `ORG_ADMIN_TOKEN`. **Why:** `workflow_call` into the private ENT repo needs a repo/org **Actions access-policy** grant. A PAT-based dispatch doesn't — a fine-grained PAT with **`Actions: read & write`** on `o2-enterprise` can trigger it. No org settings touched. **Flow:** org-member `/docgen` (gate unchanged, = trust boundary for the PAT) → resolve PR/dry-run/actor (event data via env, not spliced into commands) → `gh workflow run docgen.yml --repo o2-enterprise …` with the PAT → ack on the OSS PR. The engine runs in ENT and comments results back via the same PAT (pairs with o2-enterprise engine PR). **PAT requirement:** `ORG_ADMIN_TOKEN` needs **Actions: R/W** on `o2-enterprise` (distinct from "Workflows"), plus Issues/Pull-requests R/W on `openobserve` + `o2-enterprise` for comments (Contents/PRs on docs already present). Merge alongside the engine PR. Stranger comments still fail the `if:` → no dispatch, PAT never used. --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>