fix(ci): mint the App token from the client ID, not the app ID - #14
Merged
Conversation
actions/create-github-app-token deprecated its `app-id` input in v3.2.0 in favour of `client-id`, so every run using it logs a deprecation warning. The numeric App ID is NOT deprecated at the platform level - the INPUT is. GitHub recommends the client ID because compatibility with future App APIs depends on it: the app ID is not globally unique and the app name is not immutable. The action was already SHA-pinned to v3.2.0, so only the input changes. `HOMEBREW_APP_CLIENT_ID` is an org VARIABLE, not a secret - a client ID is not sensitive, and putting it in secrets only makes a log harder to read. It was derived from the same app's private key by hyperi-infra scripts/github-app-client-ids.py, so it pairs with `HOMEBREW_APP_PRIVATE_KEY` by construction. Refs hyperi-io/hyperi-ci#100
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every run in this repo currently logs a deprecation warning, because
actions/create-github-app-tokendeprecated itsapp-idinput in v3.2.0 infavour of
client-id.Being precise about what is deprecated, because the loose version keeps getting
repeated: the numeric App ID is NOT deprecated at the platform level and still
works. The INPUT is. GitHub separately recommends the client ID because
compatibility with future App APIs depends on it - the app ID is not globally
unique and the app name is not immutable.
HOMEBREW_APP_CLIENT_IDis an org VARIABLE, not a secret. A client ID is not sensitive, andputting it in secrets only makes a log harder to read. It was derived from the
same app's private key by hyperi-infra
scripts/github-app-client-ids.py, so itpairs with
HOMEBREW_APP_PRIVATE_KEYby construction rather than by coincidence.The action was already SHA-pinned at v3.2.0, so only the input changes.
Done when a run log shows no
app-iddeprecation warning.Part of a fleet sweep - hyperi-io/hyperi-ci#100.