Clarification around how to use "Github Pull Request" continuous translation strategy with a separate, non-forked repository.

[enpaul]

Hello, I am hoping to get some community support for an issue I'm having with my self-hosted Weblate instance.

Our continuous translation workflow relies on the "GitHub pull request from fork" method described here. We have a bot user (call them weblate-autobot) that has a Classic Personal Access Token that it uses to pull changes from myorg/myproject, push changes to weblate-autobot/myproject, and then open a PR from weblate-autobot/myproject to myorg/myproject. This has worked well for us for several years.

Recently myorg has disabled Classic PATs for security reasons in favor of Fine-Grained PATs. One of the security enhancements of Fine-Grained PATs over Classic PATs is that they can only be scoped to a single resource owner (i.e. weblate-autobot or myorg) at a time. This means that a single PAT cannot provide access to both weblate-autobot/myproject and myorg/myproject. For security reasons, we cannot allow weblate-autobot direct push access to the myorg/myproject repository.

A solution we explored was to simply move the fork repository under the myorg organization (to, say, myorg/myproject-fork). However, it appears that Weblate does not offer the ability to customize the name of the fork repository at all and, since the Fine-Grained PAT does not have cross-owner permissions, the attempt to create the fork under the weblate-autobot account fails when a push is attempted.

All of this is to say, is this functionality working as intended? Is there a better way to solve this problem that I'm not seeing? Any information or advice you can provide would be very helpful.

---

Server info:

• Weblate Version: 5.10
• Deployment method: docker compose
• Database: PostgreSQL 13.20

[nijel]

The proper long-term solution is to make Weblate be GitHub application and you would grant it desired access. This is covered by #1688, but there hasn't been much progress on this.

Until then, classic PAT are IMHO the only way to let Weblate fork a private repository and open a pull request for it.

[enpaul]

Thank you for your response @nijel!

Reading through the issue you linked, it looks like the Weblate github app is not currently able to replace Classic PATs, is that correct? Does this mean that of the three credential integration formats Github offers (Classic PATs, Fine-Grained PATs, and Apps) Weblate only supports Classic PATs?

[nijel]

Yes, the plan is to have application integration developed during this year.

PS: Fine-grained PATs works fine as long as you stay within one repository and do not fork.