ci: identify the token-minting app by client id rather than app id - #804
Merged
Conversation
actions/create-github-app-token@v3 deprecates the app-id input in favour of client-id, warning on every run that mints a token. Both call sites -- the release job's push token and the auto-merge job's merge token -- name the same app, so both move together. The numeric app id has not become meaningless: the branch ruleset still names 4473709 as the Integration bypass actor, since a ruleset identifies an app that way rather than by client id. Only this action's input changed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
actions/create-github-app-token@v3deprecated theapp-idinput in favour ofclient-id. It still works, but every run that mints a token now logs:Both call sites name the same app, so both move together: the release job's push token in
ci.yml, and the auto-merge job's merge token independabot-auto-merge.yml.The numeric app id hasn't become meaningless — the branch ruleset still names
4473709as its Integration bypass actor, because a ruleset identifies an app by app id rather than client id. Only this action's input changed.Verifying this
Neither call site is exercised by a pull request's own checks, which is how the deprecation went unnoticed when v3 landed: the Release job skips on PRs, and
dependabot-auto-merge.ymlruns the base branch's copy of the workflow underpull_request_target. So green checks here prove the workflows still parse and nothing else regressed, not that the token still mints.The real check is the push run on
mainafter this merges — the Release job runs there for real. Confirmed working means the annotation above is gone and the release job's checkout still authenticates.