From 103f19e9782fef66b636c570258654771ec22739 Mon Sep 17 00:00:00 2001 From: 0xrsydn Date: Tue, 14 Jul 2026 20:40:49 +0700 Subject: [PATCH] docs: clarify update automation token --- docs/UPDATE-POLICY.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/UPDATE-POLICY.md b/docs/UPDATE-POLICY.md index d36b41b..e7edf97 100644 --- a/docs/UPDATE-POLICY.md +++ b/docs/UPDATE-POLICY.md @@ -32,11 +32,11 @@ updater job red, but does not discard the candidate. ## Repository token Set the Actions secret `HERMES_UPDATE_TOKEN` to a fine-grained PAT or GitHub App -token with repository contents and pull-request write access. GitHub suppresses -new workflow runs for PRs created with the default `GITHUB_TOKEN`; the dedicated -token allows the candidate PR to receive normal required checks. Scheduled -updates fail clearly when this secret is absent rather than opening an unchecked -PR. +token with repository contents and pull-request write access. Pull requests +created with the default `GITHUB_TOKEN` can start workflow runs, but GitHub puts +those runs into an approval-required state. The dedicated token lets candidate +checks start automatically. Scheduled updates fail clearly when this secret is +absent rather than opening a candidate that waits for manual workflow approval. Protect `main` with the ordinary `CI / check` status and the `Nightly Candidate / check` status. The latter passes without installing Nix