ci: replace create-pull-request with a local composite action

The org's Actions policy blocks peter-evans/create-pull-request (the workflow failed at startup until the step was removed). The local action commits the listed paths without moving HEAD, force-pushes the branch, and creates, updates, leaves alone, or closes the PR.
daniellekorn · Sep 15, 2026 · Sep 16, 2026 · Sep 16, 2026 · Sep 16, 2026 · Sep 16, 2026
commit ff60471fdbf7aed5ebda731e592a879ab6867172
diff --git a/.github/actions/open-or-update-pr/action.yml b/.github/actions/open-or-update-pr/action.yml
@@ -0,0 +1,63 @@
+name: Open or update pull request
+description: >-
+  Commits the working-tree changes under `add-paths` to `branch`, pushes, and
+  opens or updates a pull request onto `base`. With no changes left, closes the
+  open pull request from `branch` (if any) and deletes the branch. Local
+  replacement for peter-evans/create-pull-request, which the org's Actions
+  policy does not allow.
+
+inputs:
+  token:
+    description: GitHub App installation token with contents and pull-requests write
+    required: true
+  bot-slug:
+    description: App slug, used as the commit author `<slug>[bot]`
+    required: true
+  path:
+    description: Repository checkout to operate on, relative to the workspace
+    required: false
+    default: "."
+  add-paths:
+    description: Newline-separated git pathspecs to commit
+    required: true
+  branch:
+    description: Pull request branch (force-pushed)
+    required: true
+  base:
+    description: Pull request base branch
+    required: false
+    default: main
+  title:
+    description: Pull request title
+    required: true
+  body-path:
+    description: File containing the pull request body
+    required: true
+  commit-message:
+    description: Commit message
+    required: true
+
+outputs:
+  operation:
+    description: created | updated | unchanged | closed | none
+    value: ${{ steps.pr.outputs.operation }}
+  url:
+    description: Pull request URL, when one exists
+    value: ${{ steps.pr.outputs.url }}
+
+runs:
+  using: composite
+  steps:
+    - id: pr
+      shell: bash
+      working-directory: ${{ inputs.path }}
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        BOT_SLUG: ${{ inputs.bot-slug }}
+        ADD_PATHS: ${{ inputs.add-paths }}
+        BRANCH: ${{ inputs.branch }}
+        BASE: ${{ inputs.base }}
+        TITLE: ${{ inputs.title }}
+        BODY_PATH: ${{ inputs.body-path }}
+        COMMIT_MESSAGE: ${{ inputs.commit-message }}
+      run: bash "$GITHUB_ACTION_PATH/open-or-update-pr.sh"
diff --git a/.github/actions/open-or-update-pr/open-or-update-pr.sh b/.github/actions/open-or-update-pr/open-or-update-pr.sh
@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# See action.yml. Runs inside the target repository checkout.
+set -euo pipefail
+
+out() { echo "$1=$2" >> "$GITHUB_OUTPUT"; echo "$1: $2"; }
+
+# Stage exactly the requested paths (deletions included).
+paths=()
+while IFS= read -r p; do [ -n "$p" ] && paths+=("$p"); done <<< "$ADD_PATHS"
+git add -A -- "${paths[@]}"
+
+git fetch -q origin "+refs/heads/${BRANCH}:refs/remotes/origin/${BRANCH}" 2>/dev/null || true
+branch_exists=false
+git show-ref -q "refs/remotes/origin/${BRANCH}" && branch_exists=true
+pr_number="$(gh pr list --head "$BRANCH" --base "$BASE" --state open --json number --jq '.[0].number // empty')"
+
+# Pushes use the App token, not whatever actions/checkout persisted.
+b64_auth="$(printf 'x-access-token:%s' "$GH_TOKEN" | base64 | tr -d '\n')"
+git config --unset-all http.https://github.com/.extraheader 2>/dev/null || true
+push() { git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${b64_auth}" push -q "$@"; }
+
+if git diff --cached --quiet; then
+  if [ -n "$pr_number" ]; then
+    gh pr close "$pr_number" --comment "Closing: \`${BASE}\` no longer differs from the source, so this change is no longer needed."
+    out operation closed
+    out url "$(gh pr view "$pr_number" --json url --jq .url)"
+  else
+    out operation none
+    out url ""
+  fi
+  [ "$branch_exists" = true ] && push origin --delete "$BRANCH"
+  exit 0
+fi
+
+if [ "$branch_exists" = true ] && [ -n "$pr_number" ] && git diff --cached --quiet "refs/remotes/origin/${BRANCH}" --; then
+  out operation unchanged
+  out url "$(gh pr view "$pr_number" --json url --jq .url)"
+  exit 0
+fi
+
+# Build the commit from the index without moving HEAD or touching any local branch.
+bot_id="$(gh api "/users/${BOT_SLUG}%5Bbot%5D" --jq .id)"
+export GIT_AUTHOR_NAME="${BOT_SLUG}[bot]" GIT_COMMITTER_NAME="${BOT_SLUG}[bot]"
+export GIT_AUTHOR_EMAIL="${bot_id}+${BOT_SLUG}[bot]@users.noreply.github.com" GIT_COMMITTER_EMAIL="${bot_id}+${BOT_SLUG}[bot]@users.noreply.github.com"
+commit="$(git commit-tree "$(git write-tree)" -p HEAD -m "$COMMIT_MESSAGE")"
+push --force origin "${commit}:refs/heads/${BRANCH}"
+
+if [ -n "$pr_number" ]; then
+  gh pr edit "$pr_number" --title "$TITLE" --body-file "$BODY_PATH" >/dev/null
+  out operation updated
+  out url "$(gh pr view "$pr_number" --json url --jq .url)"
+else
+  url="$(gh pr create --head "$BRANCH" --base "$BASE" --title "$TITLE" --body-file "$BODY_PATH")"
+  out operation created
+  out url "$url"
+fi
diff --git a/.github/workflows/publish-sdk-change-to-docs.yml b/.github/workflows/publish-sdk-change-to-docs.yml
@@ -165,29 +165,28 @@ jobs:
       # One branch per source commit.
       - name: Open pull request
         id: pr
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        uses: ./.github/actions/open-or-update-pr
         with:
           path: ${{ env.DOCS_DIR }}
           token: ${{ steps.docs-token.outputs.token }}
+          bot-slug: ${{ steps.docs-token.outputs.app-slug }}
           add-paths: |
             developers/references/sdk/docs
             */developers/references/sdk/docs/*
           branch: bot/sdk-docs/${{ steps.range.outputs.short }}
           base: main
-          delete-branch: true
-          sign-commits: true
+          title: "docs(sdk): ${{ steps.range.outputs.plain_subject }} (javascript-sdk@${{ steps.range.outputs.short }})"
+          body-path: ${{ runner.temp }}/pr-body.md
           commit-message: |
             docs(sdk): ${{ steps.range.outputs.plain_subject }}
 
             Source: https://github.com/base44/javascript-sdk/commit/${{ steps.range.outputs.head }}
-          title: "docs(sdk): ${{ steps.range.outputs.plain_subject }} (javascript-sdk@${{ steps.range.outputs.short }})"
-          body-path: ${{ runner.temp }}/pr-body.md
 
       - name: Report
         env:
           CHANGED: ${{ steps.patch.outputs.changed }}
-          OPERATION: ${{ steps.pr.outputs.pull-request-operation }}
-          URL: ${{ steps.pr.outputs.pull-request-url }}
+          OPERATION: ${{ steps.pr.outputs.operation }}
+          URL: ${{ steps.pr.outputs.url }}
         run: |
           {
             echo "## Publish SDK Change to Docs"

diff --git a/.github/workflows/sync-runtime-models.yml b/.github/workflows/sync-runtime-models.yml
@@ -18,6 +18,9 @@ on:
         default: "main"
         type: string
 
+permissions:
+  contents: read
+
 concurrency:
   group: sync-runtime-models
   cancel-in-progress: false
@@ -29,8 +32,6 @@ env:
 jobs:
   sync:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
 
     steps:
       - name: Checkout
@@ -108,15 +109,29 @@ jobs:
           permission-pull-requests: write
 
       # No diff: no-op. Open PR but no diff any more: closes it.
-      - name: Open or update pull request (TEMP experiment placeholder)
+      - name: Open or update pull request
         id: pr
-        run: echo "peter-evans/create-pull-request step removed for the allow-list experiment"
+        uses: ./.github/actions/open-or-update-pr
+        with:
+          token: ${{ steps.sdk-token.outputs.token }}
+          bot-slug: ${{ steps.sdk-token.outputs.app-slug }}
+          add-paths: src/modules/integrations.types.ts
+          branch: bot/sync-runtime-models
+          base: main
+          title: "fix(types): sync InvokeLLM model union with apper RuntimeModel"
+          body-path: ${{ runner.temp }}/pr-body.md
+          commit-message: |
+            fix(types): sync InvokeLLM model union with apper RuntimeModel
+
+            Source: ${{ env.APPER_REPO }}@${{ steps.fetch.outputs.sha }}
+            Added: ${{ steps.sync.outputs.added || '(none)' }}
+            Removed: ${{ steps.sync.outputs.removed || '(none)' }}
 
       - name: Report
         env:
           CHANGED: ${{ steps.sync.outputs.changed }}
-          OPERATION: ${{ steps.pr.outputs.pull-request-operation }}
-          URL: ${{ steps.pr.outputs.pull-request-url }}
+          OPERATION: ${{ steps.pr.outputs.operation }}
+          URL: ${{ steps.pr.outputs.url }}
         run: |
           {
             echo "## Sync Runtime Models"