fix(ci): mint the App token from the client ID, not the app ID - #2
Merged
Merged
Conversation
actions/create-github-app-token deprecated its `app-id` input in v3.2.0 in favour of `client-id`, so every run using it logs a deprecation warning. The numeric App ID is NOT deprecated at the platform level - the INPUT is. GitHub recommends the client ID because compatibility with future App APIs depends on it: the app ID is not globally unique and the app name is not immutable. The action ref moves from the floating `@v1` tag to a SHA-pinned v3.2.0 in the same commit, because it has to: `client-id` does not exist before v3, so swapping the input alone would break the mint. v3.2.0 removes only the legacy snake_case aliases (`app_id`, `private_key`, `skip_token_revoke`), none of which are used here. `HOMEBREW_APP_CLIENT_ID` is an org VARIABLE, not a secret - a client ID is not sensitive, and putting it in secrets only makes a log harder to read. It was derived from the same app's private key by hyperi-infra scripts/github-app-client-ids.py, so it pairs with `HOMEBREW_APP_PRIVATE_KEY` by construction. Refs hyperi-io/hyperi-ci#100
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every run in this repo currently logs a deprecation warning, because
actions/create-github-app-tokendeprecated itsapp-idinput in v3.2.0 infavour of
client-id.Being precise about what is deprecated, because the loose version keeps getting
repeated: the numeric App ID is NOT deprecated at the platform level and still
works. The INPUT is. GitHub separately recommends the client ID because
compatibility with future App APIs depends on it - the app ID is not globally
unique and the app name is not immutable.
HOMEBREW_APP_CLIENT_IDis an org VARIABLE, not a secret. A client ID is not sensitive, andputting it in secrets only makes a log harder to read. It was derived from the
same app's private key by hyperi-infra
scripts/github-app-client-ids.py, so itpairs with
HOMEBREW_APP_PRIVATE_KEYby construction rather than by coincidence.The action ref also moves from the floating
@v1tag to a SHA-pinned v3.2.0,and it has to move in the same commit:
client-iddoes not exist before v3, sochanging the input alone would break the token mint rather than fix a warning.
v3.2.0 drops only the legacy snake_case aliases (
app_id,private_key,skip_token_revoke), none of which this repo uses.Done when a run log shows no
app-iddeprecation warning.Part of a fleet sweep - hyperi-io/hyperi-ci#100.