fix(provisioning): auto-discover App installation, alert on failure, close registration-to-roster gap#232
Merged
Merged
Conversation
…close registration-to-roster gap Root cause of a month of failed runs: the provisioning GitHub App was never installed on the org, and the 30-minute schedule failed silently 280 times while two enrolled learners waited unprovisioned. - github-app-auth: normalize installation IDs (accept settings URLs) and discover the installation from the App when the secret is unset, with actionable 404 guidance - provision-cli: --check-auth credentials canary; template-repo preflight before the provisioning loop - new sync-intake-to-roster: [ENROLL-INTAKE] issues in the admin repo flow into roster.json automatically (idempotent, never touches existing entries) - provision-learning-rooms workflow: intake sync step, work-free early exit, roster commit on failure too, watchdog provisioning-alert issue opened on failure and closed on success, repository_dispatch trigger, healing-sweep cron instead of 30-minute polling, actions-bot spike mode removed - new provisioning-health-check workflow: weekly token mint + template access check with the same alerting - registration workflow: dispatches provisioning on enrollment, drops dead GitHub Classroom assignment links, stores [REGISTER] intake privately and redacts PII from public issue bodies - docs: SPEC 7.2a, OWNED_PROVISIONING, HYBRID_DEPLOYMENT_GUIDE updated; DEPLOYMENT_ASSESSMENT de-emojied with a July 2026 correction; full incident review in REVIEW-2026-07-02.md - hygiene: scratch tmp-* files and fix.md/fix.html removed and gitignored; authoritative-sources gate green at HEAD; HTML regenerated Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
Peer Review AssignedHi @accesswatch! Your PR has been automatically paired with @taylorarndt for peer review. For @taylorarndt:This is a great opportunity to practice code review skills! Here's what to look for: Content Quality:
Accessibility:
Documentation:
Review Guidelines:
Resources: Pairing by Learning Room Grouping Engine |
There was a problem hiding this comment.
Pull request overview
This PR hardens the “Hybrid provisioning” subsystem and workshop enrollment pipeline by removing the “installation ID as a required secret” failure mode, adding health checks and watchdog alerting, and closing the intake-to-roster gap that previously required manual updates.
Changes:
- Add GitHub App installation auto-discovery,
--check-authcredentials canary, and template-repo preflight to provisioning CLI/auth. - Update workflows to be event-driven (dispatch on enrollment), reduce polling (6h healing sweep), sync intake issues into the roster, and open/close a
provisioning-alertwatchdog issue. - Improve PII hygiene for
[REGISTER]by storing intake privately and redacting the public issue body; remove/ignore scratch artifacts and regenerate HTML/docs to match.
Reviewed changes
Copilot reviewed 33 out of 35 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| tmp-rename-audit.log | Removed scratch log file from repo root. |
| tmp-proposed-stage-1-1.csv | Removed scratch CSV artifact. |
| tmp-proposed-rename.csv | Removed scratch CSV artifact. |
| tmp-proposed-feed-order.csv | Removed scratch CSV artifact. |
| tmp-learning-room-smoke-wrapper.ps1 | Removed scratch smoke-test script. |
| tmp-learning-room-smoke-test.ps1 | Removed scratch smoke-test script. |
| tmp-crosslink-rewrite-report.txt | Removed scratch report artifact. |
| tmp-audio-inventory.csv | Removed scratch inventory artifact. |
| SPEC.md | Document updated provisioning requirements (org-wide install, optional installation ID, watchdog). |
| scripts/validate-authoritative-sources.js | Exclude CLAUDE.md from authoritative-sources validation targets. |
| REVIEW-2026-07-02.md | Added incident/operations review documenting the failure mode and remediations. |
| html/SPEC.html | Regenerated HTML for updated spec. |
| html/REVIEW-2026-07-02.html | Added generated HTML for the new ops review. |
| html/DEPLOYMENT_ASSESSMENT.html | Added generated HTML reflecting assessment correction. |
| html/CLAUDE.html | Added generated HTML for new tooling guidance doc. |
| html/admin/OWNED_PROVISIONING.html | Regenerated HTML for updated admin runbook content. |
| html/admin/HYBRID_DEPLOYMENT_GUIDE.html | Regenerated HTML for updated deployment guide content. |
| fix.md | Removed scratch/temporary doc. |
| fix.html | Removed scratch/temporary HTML doc. |
| DEPLOYMENT_ASSESSMENT.md | Replace emoji markers with ASCII labels; add July 2026 correction + source sections. |
| CLAUDE.md | Added repo/tooling guidance (commands, architecture, conventions). |
| admin/OWNED_PROVISIONING.md | Update operator runbook for org-wide install, health check, intake sync, watchdog. |
| admin/HYBRID_DEPLOYMENT_GUIDE.md | Update deployment guide for org-wide install, optional installation ID, health check gate. |
| .gitignore | Ignore scratch artifacts (tmp-*) and related generated logs. |
| .github/workflows/registration.yml | Remove Classroom links, dispatch provisioning on enrollment, store/redact registration intake. |
| .github/workflows/provisioning-health-check.yml | New weekly credentials canary workflow with alerting. |
| .github/workflows/provision-learning-rooms.yml | Intake sync + early exit + commit-on-failure + watchdog alert issue + reduced cron polling. |
| .github/scripts/provisioning/sync-intake-to-roster.js | New script to upsert open [ENROLL-INTAKE] issues into roster.json as pending learners. |
| .github/scripts/provisioning/provision-cli.js | Add --check-auth, installation discovery fallback, and template access preflight. |
| .github/scripts/provisioning/github-app-auth.js | Add installation-ID normalization, discovery via /app/installations, improved 404 guidance. |
| .github/scripts/provisioning/tests/sync-intake-to-roster.test.js | New tests for intake parsing and idempotent roster merging. |
| .github/scripts/provisioning/tests/provision-cli.test.js | New tests for --check-auth parsing and installation discovery behavior. |
| .github/scripts/provisioning/tests/github-app-auth.test.js | New tests for installation URL normalization + discovery error modes. |
| .github/scripts/tests/registration-workflow-readiness.test.js | Update readiness checks to enforce no Classroom links + verify dispatch/redaction markers. |
Comment on lines
+182
to
+184
| - name: Close provisioning alert issue on success | ||
| if: ${{ success() }} | ||
| uses: actions/github-script@v8 |
Comment on lines
8
to
+12
| permissions: | ||
| contents: write | ||
| issues: write | ||
| # Needed to dispatch the provisioning workflow when an enrollment lands. | ||
| actions: write |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The Provision Learning Rooms workflow has failed on every real run since June 2 (280 runs, 1 success - a dry run). Root cause: the provisioning GitHub App was created but never installed on the Community-Access org, so minting an installation token 404s. Two enrolled learners have been pending for a month with no alert. Full incident review: REVIEW-2026-07-02.md (included in this PR).
What changed
Provisioning subsystem:
Workflows:
Docs and hygiene:
Tests
Remaining manual step (blocking for provisioning to work)
Install the GitHub App on the Community-Access org (org-wide access), then run the Provisioning Credentials Health Check workflow. The PROVISIONING_APP_INSTALLATION_ID secret can be left unset after this PR.
🤖 Generated with Claude Code