From 73c0b550e800fca5a280dec2a864db857a3b316f Mon Sep 17 00:00:00 2001 From: Derek Date: Wed, 5 Aug 2026 13:13:49 +1000 Subject: [PATCH] fix(ci): mint the App token from the client ID, not the app ID actions/create-github-app-token deprecated its `app-id` input in v3.2.0 in favour of `client-id`, so every run using it logs a deprecation warning. The numeric App ID is NOT deprecated at the platform level - the INPUT is. GitHub recommends the client ID because compatibility with future App APIs depends on it: the app ID is not globally unique and the app name is not immutable. The action was already SHA-pinned to v3.2.0, so only the input changes. `HOMEBREW_APP_CLIENT_ID` is an org VARIABLE, not a secret - a client ID is not sensitive, and putting it in secrets only makes a log harder to read. It was derived from the same app's private key by hyperi-infra scripts/github-app-client-ids.py, so it pairs with `HOMEBREW_APP_PRIVATE_KEY` by construction. Refs hyperi-io/hyperi-ci#100 --- .github/workflows/package.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml index d260e6f..19c4d6b 100644 --- a/.github/workflows/package.yml +++ b/.github/workflows/package.yml @@ -301,9 +301,9 @@ jobs: # experimental bucket take the production homebrew push down with it. - name: Mint homebrew-tap token id: tap-token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: - app-id: ${{ secrets.HOMEBREW_APP_ID }} + client-id: ${{ vars.HOMEBREW_APP_CLIENT_ID }} private-key: ${{ secrets.HOMEBREW_APP_PRIVATE_KEY }} owner: hyperi-io repositories: homebrew-tap @@ -313,9 +313,9 @@ jobs: - name: Mint scoop-bucket token id: bucket-token continue-on-error: true - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: - app-id: ${{ secrets.HOMEBREW_APP_ID }} + client-id: ${{ vars.HOMEBREW_APP_CLIENT_ID }} private-key: ${{ secrets.HOMEBREW_APP_PRIVATE_KEY }} owner: hyperi-io repositories: scoop-bucket