fix(ci): hold create-github-app-token at v1.x in the cross-repo caller bumpers (BE-5227) - #98
Conversation
…r bumpers (BE-5227) The v1.12.0 -> v3.2.0 jump in the 2026-07-30 major group (#95) broke the owner:-without-repositories: token used by every bump-*-callers.yml. Since that merge each run 403s with "Resource not accessible by integration" on tree create for every caller repo, so no consumer has been bumped in three merges and every one is stranded on a stale pin. Evidence across the version boundary, same repo and same token config: cloud-code-bot[bot] committed Comfy-Org/cloud at 2026-07-30T23:03:17Z under v1.12.0, and 403'd on that same repo under v3.2.0. Neither the v2.0.0 nor the v3.0.0 release notes document a scoping change, so this is pinned on observed behavior rather than on a changelog entry. Scope is deliberately narrow: only the six cross-repo bumpers are reverted. The current-repo minters (groom.yml, cursor-review.yml, pr-size.yml) do not set owner:, are scoped to the running repo, and are unaffected - they stay on v3.2.0. A dependabot ignore keeps majors from silently reintroducing this.
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 22 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (7)
Comment |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
🔍 Cursor Review — Consolidated panel
Triggered by @mattmillerai.
Found 6 finding(s).
| Severity | Count |
|---|---|
| 🟠 High | 1 |
| 🟡 Medium | 4 |
| 🟢 Low | 1 |
Panel: 8/8 reviewers contributed findings.
| # NOTE: only the six bump-*-callers.yml workflows are held back. The | ||
| # current-repo minters (groom.yml, cursor-review.yml, pr-size.yml, ...) do | ||
| # not set `owner:`, are scoped to the running repo, and stay on v3.x. | ||
| - dependency-name: "actions/create-github-app-token" |
There was a problem hiding this comment.
🟠 High — A Dependabot ignore condition is scoped to the enclosing updates: entry (github-actions, directory /) and keys only on dependency name — it cannot say "these six files but not those", so the NOTE on lines 103-105 is wrong. groom.yml (x3), cursor-review.yml, cursor-review-auto-label.yml, pr-size.yml, and assign-reviewers.yml are all equally frozen out of every future major of actions/create-github-app-token, meaning a future major carrying a fix to the token minter is silently never proposed for them either. Raised by 4 of 8 reviewers (claude-opus-5-thinking-max adversarial, claude-opus-5-thinking-max edge-case, gpt-5.6-sol-max adversarial + edge-case, kimi-k2.7-code adversarial).
| # current-repo minters (groom.yml, cursor-review.yml, pr-size.yml, ...) do | ||
| # not set `owner:`, are scoped to the running repo, and stay on v3.x. | ||
| - dependency-name: "actions/create-github-app-token" | ||
| update-types: ["version-update:semver-major"] |
There was a problem hiding this comment.
🟡 Medium — actions/create-github-app-token now appears at two refs in one directory (v1.12.0 in the six bumpers, v3.2.0 in five other occurrences), but Dependabot's github-actions parser treats same-named occurrences as one dependency and tends to rewrite all of its requirements to a single ref. Because only majors are ignored, the next v1.x or v3.x minor/patch release can rewrite every occurrence uniformly — either dragging the bumpers past the v2 boundary this pin exists to avoid, or pulling the v3.x current-repo minters back to v1.x. Raised by 1 of 8 reviewers (claude-opus-5-thinking-max edge-case).
| # config, on v3.2.0. Neither the v2.0.0 nor the v3.0.0 release notes document | ||
| # a scoping change, so this is pinned by evidence, not by changelog. | ||
| # | ||
| # Scoped to majors only: v1.x patches still arrive. Lifting this needs a |
There was a problem hiding this comment.
🟡 Medium — "v1.x patches still arrive" overstates the safety margin: ignore suppresses security updates as well as version updates (this file documents exactly that at lines 81-83 for the other entry), and upstream does not backport to the dead v1 branch. In practice no update of any kind — including a security fix to the action or to the bundled @octokit/undici code in its dist/ — will be offered for the six workflows that mint the org-scoped bot token, with no PR and no signal, and nothing in the repo gives this hold an expiry. Raised by 2 of 8 reviewers (claude-opus-5-thinking-max adversarial, claude-opus-5-thinking-max edge-case).
|
|
||
| - name: Generate Cloud Code Bot token | ||
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | ||
| uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 — pinned: see dependabot.yml ignore (v2+ breaks cross-repo `owner:` token scoping) |
There was a problem hiding this comment.
🟡 Medium — Reverting to v1.12.0 restores the widest token scope: with owner: set and repositories: empty, v1 mints an installation token valid for every repo the app is installed on in the org, carrying contents/pull-requests/issues write — which is the most likely reason v2+ 403s here. Least privilege is still reachable without hardcoding caller names: repositories: accepts an expression and can be fed from the same vars.AUTO_LABEL_CALLERS list the next step already consumes via CALLERS_JSON. Applies identically to all six bumper files. Raised by 2 of 8 reviewers (claude-opus-5-thinking-max adversarial, kimi-k2.7-code adversarial).
| # has 403'd with "Resource not accessible by integration" on `tree create` | ||
| # for every caller repo, silently stranding every consumer on a stale pin. | ||
| # Verified against one repo across the boundary: cloud-code-bot[bot] wrote | ||
| # Comfy-Org/cloud at 23:03 on v1.12.0 and 403'd on the same repo, same token |
There was a problem hiding this comment.
🟡 Medium — This comment commits a specific consumer repo name (Comfy-Org/cloud), the bot identity that holds write access to it, and the timestamp of a write into a public file. AGENTS.md requires caller names to live only in the vars.*_CALLERS variables and never appear in workflow files, logs, or commit text; the same evidence reads fine with the repo anonymized ("one caller repo"). Raised by 2 of 8 reviewers (claude-opus-5-thinking-max adversarial, gpt-5.6-sol-max adversarial).
|
|
||
| - name: Generate Cloud Code Bot token | ||
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | ||
| uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 — pinned: see dependabot.yml ignore (v2+ breaks cross-repo `owner:` token scoping) |
There was a problem hiding this comment.
🟢 Low — The "do not upgrade" rationale lives in the trailing version comment, which is exactly the text Dependabot rewrites wholesale on a bump and pinact normalizes — the first permitted v1.x patch deletes the warning while the ignore silently stays in place. The free-form suffix also departs from the # vX.Y.Z form those tools parse. Put the guardrail somewhere automation will not erase. Raised by 2 of 8 reviewers (claude-opus-5-thinking-max adversarial, claude-opus-5-thinking-max edge-case).
|
Verified after merge — the cross-repo path works again. Fired All four external callers now have an open bump PR to
That is the cross-repo write this PR's dependabot-ignore comment asks for as the bar for ever lifting the pin — recording it here so the next person has the evidence rather than a green unit-test run. One residual worth its own issue: the dispatcher's failure mode gave no signal about which consumers were left behind. Three merges passed with every caller stranded on a stale pin, and the only symptom was a red run in this repo. Reporting stranded callers by name — or failing loudly once a caller drifts more than one merge behind — would have surfaced this the same day. |
3 participants
ELI-5
A robot's job is to go around to all our other repos and update a version number after we change the shared workflow. Last night an automatic dependency update gave that robot a newer keycard. The newer keycard doesn't open other repos' doors — only its own. So for the last three merges the robot has been quietly failing at every door, and every repo is still on an old version number. This puts the old keycard back for that one robot.
The break
bump-*-callers.ymlmints a cross-repo App token (owner: Comfy-Org, norepositories:) and commits the rewritten caller file via the Git Data API. Since the 2026-07-30 major group (#95) bumpedactions/create-github-app-tokenv1.12.0 → v3.2.0, every run 403s:Three consecutive failures —
3b5886b(23:02),6ed928c(02:51),8eebe24(04:10) — plus a manualworkflow_dispatchre-run to rule out a transient. No consumer has been bumped since, so every caller repo is stranded on a stale pin, silently: the dispatcher's failure is a red run in this repo that says nothing about the repos actually left behind.Why the version bump is the cause
Same repo, same token config, across the boundary:
cloud-code-bot[bot]committedComfy-Org/cloud(#5893)Comfy-Org/cloud,tree createNothing else on the bump path changed in that window — the diff between the last green run and the first red one touches only the two action pins in these workflows. Neither the v2.0.0 release notes (removed deprecated
app_id/private_key/skip_token_revoke) nor v3.0.0's (proxy handling) document a scoping change, so this is pinned on observed behavior, not a changelog entry — which is also why the ignore comment says lifting it needs a proven cross-repo write rather than a green CI run.Scope
Deliberately narrow — only the six cross-repo bumpers revert to v1.12.0:
bump-agents-md-callers·bump-assign-reviewers-callers·bump-auto-label-callers·bump-cursor-review-callers·bump-groom-callers·bump-pr-size-callersThe current-repo minters stay on v3.2.0 and are untouched:
groom.yml,cursor-review.yml,pr-size.yml,assign-reviewers.yml,cursor-review-auto-label.yml. None setowner:, so their tokens are scoped to the running repo and never crossed the boundary that broke. That split is the whole reason this is 6 files and not 11.A
dependabot.ymlignore holds majors only — v1.x patches still arrive.Verification
bcd2ba4; all current-repo minters confirmed still on it.dependabot.ymlparses;ignorenow has 2 entries.bump-groom-callersafter merge and confirming the three outstanding callers (comfy-cloud-mcp-server,comfy-local-mcp,comfy-infra) get bump PRs. I'll do that and report back on this PR.Comfy-Org/cloudwas already bumped by hand (cloud#5938) to unblockGROOM_CONFIG, so it will show asalready atrather than as a new PR.