From 683ff258815809950630b03c5a2f48ef04358c95 Mon Sep 17 00:00:00 2001 From: Matt Miller Date: Thu, 30 Jul 2026 21:21:48 -0700 Subject: [PATCH] fix(ci): hold create-github-app-token at v1.x in the cross-repo caller bumpers (BE-5227) The v1.12.0 -> v3.2.0 jump in the 2026-07-30 major group (#95) broke the owner:-without-repositories: token used by every bump-*-callers.yml. Since that merge each run 403s with "Resource not accessible by integration" on tree create for every caller repo, so no consumer has been bumped in three merges and every one is stranded on a stale pin. Evidence across the version boundary, same repo and same token config: cloud-code-bot[bot] committed Comfy-Org/cloud at 2026-07-30T23:03:17Z under v1.12.0, and 403'd on that same repo under v3.2.0. Neither the v2.0.0 nor the v3.0.0 release notes document a scoping change, so this is pinned on observed behavior rather than on a changelog entry. Scope is deliberately narrow: only the six cross-repo bumpers are reverted. The current-repo minters (groom.yml, cursor-review.yml, pr-size.yml) do not set owner:, are scoped to the running repo, and are unaffected - they stay on v3.2.0. A dependabot ignore keeps majors from silently reintroducing this. --- .github/dependabot.yml | 21 +++++++++++++++++++ .github/workflows/bump-agents-md-callers.yml | 2 +- .../bump-assign-reviewers-callers.yml | 2 +- .github/workflows/bump-auto-label-callers.yml | 2 +- .../workflows/bump-cursor-review-callers.yml | 2 +- .github/workflows/bump-groom-callers.yml | 2 +- .github/workflows/bump-pr-size-callers.yml | 2 +- 7 files changed, 27 insertions(+), 6 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 1ad5cab..c4fc618 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -85,6 +85,27 @@ updates: # forms of the dependency name. - dependency-name: "Comfy-Org/github-workflows*" + # Hold `create-github-app-token` at v1.x in the cross-repo bumpers. + # + # The v1.12.0 -> v3.2.0 jump in the 2026-07-30 major group (#95) broke the + # `owner:`-without-`repositories:` token: every bump-*-callers.yml run since + # has 403'd with "Resource not accessible by integration" on `tree create` + # for every caller repo, silently stranding every consumer on a stale pin. + # Verified against one repo across the boundary: cloud-code-bot[bot] wrote + # Comfy-Org/cloud at 23:03 on v1.12.0 and 403'd on the same repo, same token + # config, on v3.2.0. Neither the v2.0.0 nor the v3.0.0 release notes document + # a scoping change, so this is pinned by evidence, not by changelog. + # + # Scoped to majors only: v1.x patches still arrive. Lifting this needs a + # cross-repo write proven on a real caller, not a green unit-test run — + # nothing in CI exercises the cross-repo path. + # + # NOTE: only the six bump-*-callers.yml workflows are held back. The + # current-repo minters (groom.yml, cursor-review.yml, pr-size.yml, ...) do + # not set `owner:`, are scoped to the running repo, and stay on v3.x. + - dependency-name: "actions/create-github-app-token" + update-types: ["version-update:semver-major"] + # Dependency-free today, but declared so the day a module is added it is # watched rather than silently rotting — the same failure mode this file # exists to fix. diff --git a/.github/workflows/bump-agents-md-callers.yml b/.github/workflows/bump-agents-md-callers.yml index 7f95a5c..6a3df08 100644 --- a/.github/workflows/bump-agents-md-callers.yml +++ b/.github/workflows/bump-agents-md-callers.yml @@ -71,7 +71,7 @@ jobs: persist-credentials: false - name: Generate Cloud Code Bot token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 — pinned: see dependabot.yml ignore (v2+ breaks cross-repo `owner:` token scoping) id: token with: app-id: ${{ vars.APP_ID }} diff --git a/.github/workflows/bump-assign-reviewers-callers.yml b/.github/workflows/bump-assign-reviewers-callers.yml index 725be24..1ef7906 100644 --- a/.github/workflows/bump-assign-reviewers-callers.yml +++ b/.github/workflows/bump-assign-reviewers-callers.yml @@ -76,7 +76,7 @@ jobs: persist-credentials: false - name: Generate Cloud Code Bot token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 — pinned: see dependabot.yml ignore (v2+ breaks cross-repo `owner:` token scoping) id: token with: app-id: ${{ vars.APP_ID }} diff --git a/.github/workflows/bump-auto-label-callers.yml b/.github/workflows/bump-auto-label-callers.yml index e2d0bc3..b7d9bbb 100644 --- a/.github/workflows/bump-auto-label-callers.yml +++ b/.github/workflows/bump-auto-label-callers.yml @@ -102,7 +102,7 @@ jobs: persist-credentials: false - name: Generate Cloud Code Bot token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 — pinned: see dependabot.yml ignore (v2+ breaks cross-repo `owner:` token scoping) id: token with: app-id: ${{ vars.APP_ID }} diff --git a/.github/workflows/bump-cursor-review-callers.yml b/.github/workflows/bump-cursor-review-callers.yml index 2b43c4c..151b19b 100644 --- a/.github/workflows/bump-cursor-review-callers.yml +++ b/.github/workflows/bump-cursor-review-callers.yml @@ -83,7 +83,7 @@ jobs: persist-credentials: false - name: Generate Cloud Code Bot token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 — pinned: see dependabot.yml ignore (v2+ breaks cross-repo `owner:` token scoping) id: token with: app-id: ${{ vars.APP_ID }} diff --git a/.github/workflows/bump-groom-callers.yml b/.github/workflows/bump-groom-callers.yml index 442a5e0..0f8e371 100644 --- a/.github/workflows/bump-groom-callers.yml +++ b/.github/workflows/bump-groom-callers.yml @@ -82,7 +82,7 @@ jobs: persist-credentials: false - name: Generate Cloud Code Bot token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 — pinned: see dependabot.yml ignore (v2+ breaks cross-repo `owner:` token scoping) id: token with: app-id: ${{ vars.APP_ID }} diff --git a/.github/workflows/bump-pr-size-callers.yml b/.github/workflows/bump-pr-size-callers.yml index f5bd2ec..e9eda92 100644 --- a/.github/workflows/bump-pr-size-callers.yml +++ b/.github/workflows/bump-pr-size-callers.yml @@ -75,7 +75,7 @@ jobs: persist-credentials: false - name: Generate Cloud Code Bot token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 — pinned: see dependabot.yml ignore (v2+ breaks cross-repo `owner:` token scoping) id: token with: app-id: ${{ vars.APP_ID }}