Skip to content

Adds nightly-changelog.yml on main so the cron registers#5482

Merged
kellyguo11 merged 4 commits into
isaac-sim:mainfrom
hujc7:jichuanh/changelog-workflows-on-main
May 5, 2026
Merged

Adds nightly-changelog.yml on main so the cron registers#5482
kellyguo11 merged 4 commits into
isaac-sim:mainfrom
hujc7:jichuanh/changelog-workflows-on-main

Conversation

@hujc7
Copy link
Copy Markdown
Collaborator

@hujc7 hujc7 commented May 4, 2026

Why

PR #5434 landed the fragment-based changelog system on develop. The accompanying nightly workflow file only lives on develop. GitHub registers schedule: triggers from the default branch only (main for this repo) — so the cron has not fired since #5434 merged, and fragments have been accumulating on develop without ever being compiled into CHANGELOG.rst / extension.toml bumps.

As of this writing, 7 fragments are stranded across 6 packages on develop.

What this PR does

Adds nightly-changelog.yml to main, mirroring the convention already used by other scheduled workflows in this repo (check-links.yml, daily-compatibility.yml both live on both branches for the same reason).

The workflow's checkout step explicitly pulls develop at run time (actions/checkout@... ref: develop), so the runtime — tools/changelog/cli.py and the per-package fragments — stays on develop. Only the trigger file needs to be on main, just to satisfy GitHub's default-branch registration rule for cron.

A header comment was added to the YAML noting the dual-location requirement so future editors know to land changes on both branches.

What this PR does not touch

  • changelog-check.yml — its pull_request trigger fires from PR-branch files and works correctly today. No need to put it on main.
  • tools/changelog/cli.py and other runtime code — unchanged on develop.
  • Any source/changelog.d/ fragments.

After merge

The next 5 AM UTC cron will sweep up the accumulated develop-fragments backlog. From then on, daily compile + auto-commit to develop should work as designed in #5434.

Test plan

  • nightly-changelog.yml content on this PR is byte-equal to develop's, plus the dual-location header comment.
  • After merge, watch the next scheduled run at 5 AM UTC and verify the auto-commit lands on develop.
  • Confirm gh workflow run "Nightly Changelog Compilation" --repo isaac-sim/IsaacLab --ref develop succeeds (manual workflow_dispatch should work once registered).

Live tested on a fork during #5434 development — the workflow body itself is verified end-to-end (single fragment, 7-fragment multi-package, cross-section merge). This PR is purely about getting the cron registered upstream.

cc @kellyguo11

GitHub only registers ``schedule:`` triggers from the repository's
default branch (``main``). The fragment-based changelog system landed
in isaac-sim#5434 with ``nightly-changelog.yml`` only on ``develop``, so the
nightly cron has not been firing — fragments accumulate without ever
being compiled.

This adds the same workflow file to ``main`` so the cron registers
and runs daily. The workflow's checkout step pulls ``develop`` at run
time, so the runtime (``tools/changelog/cli.py``, fragments) stays
on develop — only the trigger file needs to live on main, mirroring
the convention already used by ``check-links.yml`` and
``daily-compatibility.yml``.

A header comment in the YAML notes the dual-location requirement so
future editors are aware.

The PR-time gate (``changelog-check.yml``) is unaffected — its
``pull_request`` trigger fires from PR-branch files and already works
correctly without being on main.
Copy link
Copy Markdown

@isaaclab-review-bot isaaclab-review-bot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 Isaac Lab Review Bot

Summary

This PR adds the nightly-changelog.yml workflow file to the main branch so GitHub's cron scheduler will register the scheduled trigger. This is a well-documented infrastructure fix addressing the fact that GitHub only registers schedule: triggers from the default branch. The workflow itself checks out and operates on develop, so the runtime behavior is correct.

Architecture Impact

Self-contained CI infrastructure change. The workflow:

  1. Triggers on cron (5 AM UTC) or manual dispatch
  2. Checks out develop branch explicitly
  3. Runs tools/changelog/cli.py compile --all (which lives on develop)
  4. Commits and pushes back to develop

No impact on Isaac Lab source code, simulation runtime, or RL training paths. The only downstream effect is that changelog fragments on develop will now be automatically compiled nightly as originally intended by PR #5434.

Implementation Verdict

Ship it — Minor improvements possible but not blocking.

Test Coverage

This is a CI workflow file; traditional unit tests don't apply. The author notes:

  • Live tested on a fork during #5434 development
  • Post-merge verification plan includes watching the 5 AM UTC cron run
  • Manual workflow_dispatch test planned

This is appropriate coverage for a CI workflow change.

CI Status

No CI checks available yet. For a workflow-only change targeting main, this is expected — the workflow syntax is valid YAML and uses pinned action SHAs.

Findings

🔵 Improvement: .github/workflows/nightly-changelog.yml:91-93 — git add may fail silently if paths don't exist

git add source/*/changelog.d/ \
        source/*/docs/CHANGELOG.rst \
        source/*/config/extension.toml

If no packages have changelog fragments or the directory structure changes, the glob may match nothing. Consider using git add --ignore-missing or checking glob expansion. However, since git diff --staged --quiet follows immediately and handles the "nothing staged" case gracefully, this is non-blocking.

🔵 Improvement: .github/workflows/nightly-changelog.yml:113-115 — awk pattern may miss version lines with leading whitespace

old=$(git diff --staged "$tom" | awk -F'"' '/^-version/{print $2; exit}')
new=$(git diff --staged "$tom" | awk -F'"' '/^\+version/{print $2; exit}')

The regex /^-version/ and /^\+version/ assume version appears at column 0 in the TOML. If extension.toml uses version = "..." with leading spaces (inside a [package] section, for example), these won't match. A safer pattern would be /^[-+][ \t]*version/. That said, if the existing extension.toml files consistently have version at the start of a line, this works. Non-blocking but worth verifying against actual file format.

🔵 Improvement: .github/workflows/nightly-changelog.yml:119 — Commit message uses UTF-8 arrow character

echo "- $pkg: $old$new"

The character (U+2192) should render fine in GitHub's UI and most terminals, but if there are encoding issues in some log viewers, consider using -> instead. Cosmetic only.

🟡 Warning: .github/workflows/nightly-changelog.yml:122-124 — No error handling on push failure

git commit -F "$MSG_FILE"
git push origin HEAD:develop

If the push fails (network issue, branch protection rule, concurrent push from another workflow), the job fails but there's no retry or notification mechanism. The next nightly run should pick up where this left off since fragments aren't deleted until the commit succeeds, so data loss is unlikely. However, consider adding || exit 1 explicitly after push or using workflow failure notifications. Non-blocking since GitHub Actions will mark the job as failed anyway.

🔵 Improvement: .github/workflows/nightly-changelog.yml:69-70 — Token fallback documented but CHANGELOG_PAT secret may not exist
The workflow gracefully falls back to GITHUB_TOKEN if CHANGELOG_PAT isn't configured, which is correct. The header comment (lines 20-27) explains the tradeoff well. No action needed, just confirming this is intentional and documented.

@greptile-apps
Copy link
Copy Markdown
Contributor

greptile-apps Bot commented May 4, 2026

Greptile Summary

This PR adds nightly-changelog.yml to main so GitHub registers the schedule: cron trigger (GitHub only reads scheduled triggers from the default branch). The workflow body checks out develop at runtime, compiles accumulated changelog fragments via tools/changelog/cli.py, and pushes the result back to develop — following the same dual-branch convention used by check-links.yml and daily-compatibility.yml.

Confidence Score: 4/5

Safe to merge — single workflow file addition with well-documented intent and no logic bugs; one minor P2 style note on missing timeout.

Only P2 findings (missing job timeout); no P0/P1 issues. The fallback token expression, dry-run gating, concurrency settings, and hardcoded ref: develop checkout are all intentional and correctly implemented.

No files require special attention beyond the single P2 note on nightly-changelog.yml.

Important Files Changed

Filename Overview
.github/workflows/nightly-changelog.yml New scheduled workflow added to main to register the GitHub cron trigger; checks out develop at runtime and pushes compiled changelog back to develop. Logic is well-commented and consistent with repo conventions, with one minor concern around missing job timeout.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["schedule: cron 0 5 UTC\nregistered from main branch"] --> C
    B["workflow_dispatch\ndry_run input"] --> C
    C["checkout develop\nfull history fetch-depth 0"] --> D
    D["setup-python 3.12"] --> E
    E["cli.py compile --all\noptional --dry-run flag"]
    E -->|dry_run true| F["Preview only — no commit"]
    E -->|dry_run false or schedule| G["git add changelog fragments\nCHANGELOG.rst + extension.toml"]
    G --> H{Staged changes?}
    H -->|No| I["Nothing to commit"]
    H -->|Yes| J["git commit with auto-version bump message"]
    J --> K["git push origin HEAD:develop"]
Loading

Reviews (1): Last reviewed commit: "Add nightly-changelog.yml on main so cro..." | Re-trigger Greptile

Comment on lines +62 to +63
# Operate on develop, not the repo's default branch. Scheduled
# workflows fire from the default branch's workflow file by
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Missing job timeout

The compile-changelog job has no timeout-minutes setting. If cli.py compile hangs (e.g., waiting on a lock, infinite loop in a malformed fragment) or the push stalls, the job will run for GitHub's default 6-hour maximum before being cancelled, blocking the nightly-changelog concurrency group for the entire window and preventing any follow-up manual dispatches from starting.

Suggested change
# Operate on develop, not the repo's default branch. Scheduled
# workflows fire from the default branch's workflow file by
runs-on: ubuntu-latest
timeout-minutes: 30

@github-actions github-actions Bot added the documentation Improvements or additions to documentation label May 4, 2026
Copy link
Copy Markdown

@isaaclab-review-bot isaaclab-review-bot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 Isaac Lab Review Bot

Summary

This is a follow-up review. The new commits add a .github/workflows/README.md documentation file explaining the dual-branch requirement for scheduled workflows. The core workflow file (nightly-changelog.yml) is unchanged from the previous review.

Implementation Verdict

Ship it

Findings

No new issues. The added README.md is a helpful documentation addition that explains the main/develop dual-location requirement for scheduled workflows — this directly addresses the "why is this file on main?" question future maintainers will have.

Previous findings remain valid but were all marked as non-blocking improvements (🔵) or low-severity warnings (🟡). None require changes before merge.

The failing "Check for Broken Links" CI job is unrelated to this PR's changes (workflow files don't contain documentation links that would be checked).

Copy link
Copy Markdown

@isaaclab-review-bot isaaclab-review-bot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 Isaac Lab Review Bot

Summary

This is a follow-up review. No new commits have been added since the previous review — the HEAD is still ef70601f. The workflow file and README remain unchanged.

Implementation Verdict

Ship it

Findings

No new issues. The previous review already approved this PR with no blocking concerns. The failing "Check for Broken Links" CI job is unrelated to this PR (it checks documentation links, not workflow files). Ready to merge once CI stabilizes.

Copy link
Copy Markdown

@isaaclab-review-bot isaaclab-review-bot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 Isaac Lab Review Bot

Summary

Follow-up review after commit 6af12896. The changes are identical to the previous review — the workflow file and README content are unchanged. This PR correctly adds the nightly changelog workflow to main to enable GitHub's cron registration.

Implementation Verdict

Ship it

Findings

No new issues. The previous approval stands. The "Check for Broken Links" CI failure is unrelated to this PR's changes (it's a documentation link checker, not a workflow validator). Ready to merge.

@kellyguo11 kellyguo11 changed the title Add nightly-changelog.yml on main so the cron registers Adds nightly-changelog.yml on main so the cron registers May 5, 2026
@kellyguo11 kellyguo11 merged commit 090aed1 into isaac-sim:main May 5, 2026
10 of 11 checks passed
hujc7 added a commit that referenced this pull request May 8, 2026
…sh (#5527)

## Why

Develop's branch ruleset requires 18 status checks **and** 1 approval
before any push. The nightly compile workflow
(#5482) was authenticated with
`GITHUB_TOKEN` (identity `github-actions[bot]`), which has neither the
bypass entitlement nor a way to satisfy approvals. Result: the cron
pushed cleanly until it hit develop, then failed with `protected branch
hook declined` — fragments accumulate, no auto-bump happens.

Confirmed failure:
https://github.com/isaac-sim/IsaacLab/actions/runs/25419200769

## What this PR does

Switches the workflow's checkout/push token to a short-lived
installation access token minted from the `isaaclab-bot` GitHub App
(created by @kellyguo11 and added to develop's ruleset bypass list).

| Change | Effect |
|---|---|
| Add `actions/create-github-app-token@v3.1.1` step (SHA-pinned) | Mints
a 1-hour installation token from `CHANGELOG_APP_ID` +
`CHANGELOG_APP_PRIVATE_KEY` repo secrets. |
| `actions/checkout` token: `app-token` instead of `GITHUB_TOKEN` | Push
is signed by `isaaclab-bot[bot]` — the bypass identity. Lands without
satisfying required-checks / required-approval. |
| `git config user.{name,email}` updated to `isaaclab-bot[bot]` |
Auto-commits attribute to the bot user in the GitHub UI. |
| Workflow `permissions: contents: write` → `contents: read` | The App
token carries write access; `GITHUB_TOKEN` only needs read. Tightens
least-privilege. |
| Header comment rewritten | Documents the App-token model + bypass
requirement. |

## Side benefit: triggers downstream workflows

`GITHUB_TOKEN`-signed pushes don't trigger downstream workflows by
design (loop guard). App-token-signed pushes are treated as external
pushes and DO trigger downstream CI — so docs / Docker rebuild jobs fire
on the auto-commit naturally, no separate PAT required.

## Setup status

Already done by maintainers:
- [x] `isaaclab-bot` GitHub App created with `contents: write`
permission
- [x] App installed on `isaac-sim/IsaacLab`
- [x] App added to develop's ruleset bypass actor list
- [x] Repo secrets `CHANGELOG_APP_ID` and `CHANGELOG_APP_PRIVATE_KEY`
set

## Test plan

- [x] PR diff is YAML-only, no code changes.
- [ ] After merge: manually trigger via `gh workflow run "Nightly
Changelog Compilation" --repo isaac-sim/IsaacLab` and verify the push
lands and the bot user shows as the commit author on
https://github.com/isaac-sim/IsaacLab/commits/develop.
- [ ] Confirm the next 5 AM UTC cron sweeps the accumulated fragment
backlog (~22 fragments at last count).

cc @kellyguo11
Fichtl00 pushed a commit to Fichtl00/IsaacLab_teleop that referenced this pull request May 12, 2026
…sh (isaac-sim#5527)

Develop's branch ruleset requires 18 status checks **and** 1 approval
before any push. The nightly compile workflow
(isaac-sim#5482) was authenticated with
`GITHUB_TOKEN` (identity `github-actions[bot]`), which has neither the
bypass entitlement nor a way to satisfy approvals. Result: the cron
pushed cleanly until it hit develop, then failed with `protected branch
hook declined` — fragments accumulate, no auto-bump happens.

Confirmed failure:
https://github.com/isaac-sim/IsaacLab/actions/runs/25419200769

Switches the workflow's checkout/push token to a short-lived
installation access token minted from the `isaaclab-bot` GitHub App
(created by @kellyguo11 and added to develop's ruleset bypass list).

| Change | Effect |
|---|---|
| Add `actions/create-github-app-token@v3.1.1` step (SHA-pinned) | Mints
a 1-hour installation token from `CHANGELOG_APP_ID` +
`CHANGELOG_APP_PRIVATE_KEY` repo secrets. |
| `actions/checkout` token: `app-token` instead of `GITHUB_TOKEN` | Push
is signed by `isaaclab-bot[bot]` — the bypass identity. Lands without
satisfying required-checks / required-approval. |
| `git config user.{name,email}` updated to `isaaclab-bot[bot]` |
Auto-commits attribute to the bot user in the GitHub UI. |
| Workflow `permissions: contents: write` → `contents: read` | The App
token carries write access; `GITHUB_TOKEN` only needs read. Tightens
least-privilege. |
| Header comment rewritten | Documents the App-token model + bypass
requirement. |

`GITHUB_TOKEN`-signed pushes don't trigger downstream workflows by
design (loop guard). App-token-signed pushes are treated as external
pushes and DO trigger downstream CI — so docs / Docker rebuild jobs fire
on the auto-commit naturally, no separate PAT required.

Already done by maintainers:
- [x] `isaaclab-bot` GitHub App created with `contents: write`
permission
- [x] App installed on `isaac-sim/IsaacLab`
- [x] App added to develop's ruleset bypass actor list
- [x] Repo secrets `CHANGELOG_APP_ID` and `CHANGELOG_APP_PRIVATE_KEY`
set

- [x] PR diff is YAML-only, no code changes.
- [ ] After merge: manually trigger via `gh workflow run "Nightly
Changelog Compilation" --repo isaac-sim/IsaacLab` and verify the push
lands and the bot user shows as the commit author on
https://github.com/isaac-sim/IsaacLab/commits/develop.
- [ ] Confirm the next 5 AM UTC cron sweeps the accumulated fragment
backlog (~22 fragments at last count).

cc @kellyguo11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Improvements or additions to documentation infrastructure

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants