⚠️ Potential issue | 🟡 Minor

🏁 Script executed:

find .github -name "update-doc-db.yml" -type f

Repository: RustPython/RustPython

Length of output: 100

🏁 Script executed:

cat -n .github/workflows/update-doc-db.yml | head -120

Repository: RustPython/RustPython

Length of output: 4365

🏁 Script executed:

ls -la .github/workflows/ | grep -i update

Repository: RustPython/RustPython

Length of output: 132

🏁 Script executed:

find . -name "*.yml" -o -name "*.yaml" | grep -i update

Repository: RustPython/RustPython

Length of output: 102

🏁 Script executed:

git ls-files .github/workflows/ | head -20

Repository: RustPython/RustPython

Length of output: 264

🏁 Script executed:

ls -la .github/ 2>/dev/null || echo "Checking git tracked files"; git ls-files .github/ | head -20

Repository: RustPython/RustPython

Length of output: 887

🏁 Script executed:

git ls-files | grep -E "\.github.*\.(yml|yaml)$" | sort

Repository: RustPython/RustPython

Length of output: 287

🏁 Script executed:

rg -l "Commit and push (non-main branches only)" --type yaml

Repository: RustPython/RustPython

Length of output: 47

🏁 Script executed:

rg "AUTO_COMMIT_PAT" --type yaml

Repository: RustPython/RustPython

Length of output: 47

🏁 Script executed:

rg "Update doc DB for CPython" --type yaml

Repository: RustPython/RustPython

Length of output: 47

🌐 Web query:

GitHub Actions sparse checkout git operations authentication

💡 Result:

Summary + quick examples

1. Use actions/checkout sparse options to do sparse-checkout in a workflow:

• inputs: sparse-checkout (newline-separated patterns), sparse-checkout-cone-mode (true/false), fetch-depth, filter (partial clone).
  Example:
  • uses: actions/checkout@v6
    with:
    fetch-depth: 0
    sparse-checkout: |
    .github
    src
    sparse-checkout-cone-mode: true
    (cite: actions/checkout). [1]

2. Authenticated git operations in the job

• By default actions/checkout persists an auth token into local git config so subsequent git commands (fetch, push) run authenticated. That token is the job-scoped GITHUB_TOKEN. Use persist-credentials: true to keep it (default). To push from a workflow you also need appropriate token permissions (contents: write) — set repository permissions in the workflow or use a PAT (secret) if you need broader scopes or create new workflow runs. GITHUB_TOKEN expires at job end and actions-triggered events from it don’t re-run workflows. [2]

Example push with GITHUB_TOKEN:
permissions:
contents: write
jobs:
push:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
with:
persist-credentials: true
fetch-depth: 0
sparse-checkout: |
README.md
- run: |
git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
# make changes...
git add .
git commit -m "Update"
git push origin HEAD:main

If you need to use a PAT (for cross-repo write, finer scopes, or to trigger new workflows), store it as a secret and set actions/checkout.token or configure git remote HTTPS with that PAT. [1][2]

3. Caveats & troubleshooting

• Sparse/partial-clone behavior depends on Git and runner versions; some git versions and combinations of partial-clone/filter vs sparse-checkout have known issues (see issues where sparse may fall back to full checkout). If you see all files fetched, try changing cone-mode, fetch-depth, or use full fetch-depth: 0 and explicit git sparse-checkout commands on the runner. Test runner git version and update if needed. [1][3]

References
[1] actions/checkout README (sparse-checkout inputs & usage).
[2] GitHub Docs — GITHUB_TOKEN and using it for authentication in workflows.
[3] actions/checkout GitHub issues (sparse-checkout / git-version caveats).

🏁 Script executed:

git ls-files .github/ 2>/dev/null | head -50

Repository: RustPython/RustPython

Length of output: 509

🏁 Script executed:

test -d .github && find .github -type f | head -30 || echo ".github directory not found in current repo"

Repository: RustPython/RustPython

Length of output: 509

Ensure the AUTO_COMMIT_PAT secret is configured in repository settings with write access.

The merge job requires the AUTO_COMMIT_PAT secret to authenticate git push operations. Configure this secret in your repository settings with appropriate permissions to push commits to non-main branches. The workflow correctly uses the full repository checkout (without sparse checkout) for the merge and commit step, so git operations will work as expected.

.github/workflows/update-doc-db.yml lines 99-108: the workflow assumes a
push-able token but doesn't ensure one is provided; configure the
AUTO_COMMIT_PAT secret in the repository settings with repo write permissions
and update the workflow to use it when pushing (for example export a GIT_TOKEN
env from secrets.AUTO_COMMIT_PAT and run git remote set-url origin
https://x-access-token:${GIT_TOKEN}@github.com/${{ github.repository }}.git
before git push); also ensure the workflow has repository write permissions
enabled so the push succeeds.