Set the SUBMIT_TOKEN secret so the submission workflow can open PRs

[compscidr]

The Submission workflow (.github/workflows/submit.yml) validates plugin submissions from the issue form and comments the result, but it can only push the submit/<owner>-<name> branch and open the registry.yaml PR when the repository secret SUBMIT_TOKEN is set. The default GITHUB_TOKEN cannot: this org disables "Allow GitHub Actions to create and approve pull requests", and PRs created by GITHUB_TOKEN would not trigger Validate anyway. Until it is set, passing submissions get a comment asking a maintainer to add the entry by hand.

Setup (dedicated machine user + fine-grained PAT)

1. Create a machine user — a new GitHub account (e.g. goblog-bot) with an email you control. Its name is what appears on submission PRs and issue comments.
2. Add it to the org — github.com/orgs/goblogplatform/people → Invite → role Member. Then repo Settings → Collaborators and teams on goblogplatform/plugins → add the bot with Write (not admin). Accept the invite from the bot account. (A fine-grained PAT can't exceed the account's own access, so Write is required for Contents write to work.)
3. Mint the PAT from the bot account — Settings → Developer settings → Personal access tokens → Fine-grained tokens → Generate:
   • Resource owner: goblogplatform
   • Repository access: Only select repositories → goblogplatform/plugins
   • Repository permissions: Contents: Read and write, Pull requests: Read and write, Issues: Read and write (Metadata: Read is added automatically)
   • Expiration: 1 year (GitHub emails the bot before expiry)
4. Approve the token in the org if the org requires approval of fine-grained PATs: github.com/organizations/goblogplatform/settings/personal-access-token-requests (or relax the policy under org Settings → Personal access tokens).
5. Store the secret from a maintainer account:

   gh secret set SUBMIT_TOKEN -R goblogplatform/plugins
   

   Paste the token at the prompt.
6. Test end-to-end via the "Submit a plugin" issue form:
   • goblogplatform/goblog-plugin-hello → expect an "already listed" comment from the bot.
   • goblogplatform/goblog → expect a validation-failure comment.
   • A fresh valid plugin repo → expect a submit/… PR opened by the bot and a "Validation passed — opened …" comment.

Alternative: GitHub App

A GitHub App (Contents, Pull requests, Issues write on this repo) avoids the second account, but submit.yml would need an actions/create-github-app-token step and two secrets (app ID + private key) instead of SUBMIT_TOKEN. Open a PR for that if preferred.

See README → Submissions and docs/CONTRACT.md §Submitting.

🤖 Generated with Claude Code