diff --git a/CHANGELOG.md b/CHANGELOG.md index afe1118bc..ec0e38b3d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,17 @@ All notable changes to GBrain will be documented in this file. +## [0.33.2.1] - 2026-05-14 + +**Doc-only: name the fork-PR escape hatch so AI-authored PRs don't drop their CI secrets.** + +PRs from `garrytan-agents` (the AI-authored PR account) live in a fork. GitHub's `pull_request` event doesn't ship base-repo secrets to forks by default, so any CI job that needs `ANTHROPIC_API_KEY` or `OPENAI_API_KEY` quietly fails with empty-env auth errors regardless of what's set on the base repo. CLAUDE.md now documents the move-branch-to-base-repo workflow as the narrow-scope alternative to adding the account as a collaborator (which would broaden secret distribution to every PR from that account) or flipping the repo-wide fork-secret toggle (which would broaden it to every fork PR). + +### Itemized changes + +- `CLAUDE.md` gets a new `## Checking out PRs from garrytan-agents` section between "Community PR wave process" and "Skill routing". Four-step recipe: `gh pr checkout ` → `git push origin HEAD:` → `gh pr close ` → `gh pr create --base master --head `, preserving the original title and body verbatim. Closes the friction Garry hit landing #962 / Voyage 2048-dim fixup PRs from the agent account. +- `llms-full.txt` regenerated by `bun run build:llms` so the committed doc bundle matches the live CLAUDE.md. Pinned by `test/build-llms.test.ts` in CI shard 1. + ## [0.33.1.1] - 2026-05-13 **Voyage 2048-dim brains finally produce 2048-dim vectors. Fail-loud on every Voyage misconfiguration.** diff --git a/CLAUDE.md b/CLAUDE.md index 13d3dfabd..5c6ec36a4 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -1520,6 +1520,36 @@ Never merge external PRs directly into master. Instead, use the "fix wave" workf - Never auto-merge PRs that remove YC references or "neutralize" the founder perspective. - Preserve contributor attribution in commit messages. +## Checking out PRs from garrytan-agents + +`garrytan-agents` is the AI-authored PR account and is NOT a collaborator on +this repo. Its PRs live in a fork, so GitHub Actions triggered by +`pull_request` events on those PRs do not receive base-repo secrets. Any CI +job that needs `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, or similar will fail +with empty-env auth errors, regardless of what's set on the base repo. This +is a GitHub security default, not a config bug. + +When the user says "check out " and the PR is from `garrytan-agents` +(or any other non-collaborator fork), move the branch into the base repo +before running CI: + +1. `gh pr checkout ` — pull down the fork's branch. Note the PR number and + head branch name (`gh pr view --json headRefName --jq .headRefName`). +2. `git push origin HEAD:` — push the same branch to the base + repo (origin points at `garrytan/gbrain`, not the fork). This is the move + that gives CI access to secrets. +3. `gh pr close --comment "moving to base-repo branch for secret access"` + — close the fork PR so the queue stays clean. +4. `gh pr create --base master --head ` — open the replacement + PR from the base-repo branch. **Preserve the original PR's title and body + verbatim** (`gh pr view --json title,body`); contributor attribution + moves to a `Co-Authored-By:` trailer if needed. + +Why this over alternatives: adding `garrytan-agents` as a collaborator, or +flipping the repo-wide "send secrets to fork PRs" toggle, both broaden +secret distribution to every fork PR from that account or any fork. Moving +the branch keeps secret scope tight to just the one PR being shipped. + ## Skill routing When the user's request matches an available skill, ALWAYS invoke it using the Skill diff --git a/VERSION b/VERSION index 788dd47db..ef1354c28 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -0.33.1.1 +0.33.2.1 diff --git a/llms-full.txt b/llms-full.txt index bc1d4f6c3..2cbcf1ca5 100644 --- a/llms-full.txt +++ b/llms-full.txt @@ -1628,6 +1628,36 @@ Never merge external PRs directly into master. Instead, use the "fix wave" workf - Never auto-merge PRs that remove YC references or "neutralize" the founder perspective. - Preserve contributor attribution in commit messages. +## Checking out PRs from garrytan-agents + +`garrytan-agents` is the AI-authored PR account and is NOT a collaborator on +this repo. Its PRs live in a fork, so GitHub Actions triggered by +`pull_request` events on those PRs do not receive base-repo secrets. Any CI +job that needs `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, or similar will fail +with empty-env auth errors, regardless of what's set on the base repo. This +is a GitHub security default, not a config bug. + +When the user says "check out " and the PR is from `garrytan-agents` +(or any other non-collaborator fork), move the branch into the base repo +before running CI: + +1. `gh pr checkout ` — pull down the fork's branch. Note the PR number and + head branch name (`gh pr view --json headRefName --jq .headRefName`). +2. `git push origin HEAD:` — push the same branch to the base + repo (origin points at `garrytan/gbrain`, not the fork). This is the move + that gives CI access to secrets. +3. `gh pr close --comment "moving to base-repo branch for secret access"` + — close the fork PR so the queue stays clean. +4. `gh pr create --base master --head ` — open the replacement + PR from the base-repo branch. **Preserve the original PR's title and body + verbatim** (`gh pr view --json title,body`); contributor attribution + moves to a `Co-Authored-By:` trailer if needed. + +Why this over alternatives: adding `garrytan-agents` as a collaborator, or +flipping the repo-wide "send secrets to fork PRs" toggle, both broaden +secret distribution to every fork PR from that account or any fork. Moving +the branch keeps secret scope tight to just the one PR being shipped. + ## Skill routing When the user's request matches an available skill, ALWAYS invoke it using the Skill diff --git a/package.json b/package.json index ebbdea01b..ba5c81f85 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "gbrain", - "version": "0.33.1.1", + "version": "0.33.2.1", "description": "Postgres-native personal knowledge brain with hybrid RAG search", "type": "module", "main": "src/core/index.ts",