Skip to content

fix(ci): hold create-github-app-token at v1.x in the cross-repo caller bumpers (BE-5227) #98

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mattmillerai merged 1 commit into from
Jul 31, 2026
Merged

fix(ci): hold create-github-app-token at v1.x in the cross-repo caller bumpers (BE-5227) #98

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,27 @@ updates:
# forms of the dependency name.
- dependency-name: "Comfy-Org/github-workflows*"

# Hold `create-github-app-token` at v1.x in the cross-repo bumpers.
#
# The v1.12.0 -> v3.2.0 jump in the 2026-07-30 major group (#95) broke the
# `owner:`-without-`repositories:` token: every bump-*-callers.yml run since
# has 403'd with "Resource not accessible by integration" on `tree create`
# for every caller repo, silently stranding every consumer on a stale pin.
# Verified against one repo across the boundary: cloud-code-bot[bot] wrote
# Comfy-Org/cloud at 23:03 on v1.12.0 and 403'd on the same repo, same token

@github-actions github-actions Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Medium — This comment commits a specific consumer repo name (Comfy-Org/cloud), the bot identity that holds write access to it, and the timestamp of a write into a public file. AGENTS.md requires caller names to live only in the vars.*_CALLERS variables and never appear in workflow files, logs, or commit text; the same evidence reads fine with the repo anonymized ("one caller repo"). Raised by 2 of 8 reviewers (claude-opus-5-thinking-max adversarial, gpt-5.6-sol-max adversarial).

# config, on v3.2.0. Neither the v2.0.0 nor the v3.0.0 release notes document
# a scoping change, so this is pinned by evidence, not by changelog.
#
# Scoped to majors only: v1.x patches still arrive. Lifting this needs a

@github-actions github-actions Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Medium — "v1.x patches still arrive" overstates the safety margin: ignore suppresses security updates as well as version updates (this file documents exactly that at lines 81-83 for the other entry), and upstream does not backport to the dead v1 branch. In practice no update of any kind — including a security fix to the action or to the bundled @​octokit/undici code in its dist/ — will be offered for the six workflows that mint the org-scoped bot token, with no PR and no signal, and nothing in the repo gives this hold an expiry. Raised by 2 of 8 reviewers (claude-opus-5-thinking-max adversarial, claude-opus-5-thinking-max edge-case).

# cross-repo write proven on a real caller, not a green unit-test run —
# nothing in CI exercises the cross-repo path.
#
# NOTE: only the six bump-*-callers.yml workflows are held back. The
# current-repo minters (groom.yml, cursor-review.yml, pr-size.yml, ...) do
# not set `owner:`, are scoped to the running repo, and stay on v3.x.
- dependency-name: "actions/create-github-app-token"

@github-actions github-actions Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 High — A Dependabot ignore condition is scoped to the enclosing updates: entry (github-actions, directory /) and keys only on dependency name — it cannot say "these six files but not those", so the NOTE on lines 103-105 is wrong. groom.yml (x3), cursor-review.yml, cursor-review-auto-label.yml, pr-size.yml, and assign-reviewers.yml are all equally frozen out of every future major of actions/create-github-app-token, meaning a future major carrying a fix to the token minter is silently never proposed for them either. Raised by 4 of 8 reviewers (claude-opus-5-thinking-max adversarial, claude-opus-5-thinking-max edge-case, gpt-5.6-sol-max adversarial + edge-case, kimi-k2.7-code adversarial).

update-types: ["version-update:semver-major"]

@github-actions github-actions Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Medium — actions/create-github-app-token now appears at two refs in one directory (v1.12.0 in the six bumpers, v3.2.0 in five other occurrences), but Dependabot's github-actions parser treats same-named occurrences as one dependency and tends to rewrite all of its requirements to a single ref. Because only majors are ignored, the next v1.x or v3.x minor/patch release can rewrite every occurrence uniformly — either dragging the bumpers past the v2 boundary this pin exists to avoid, or pulling the v3.x current-repo minters back to v1.x. Raised by 1 of 8 reviewers (claude-opus-5-thinking-max edge-case).


# Dependency-free today, but declared so the day a module is added it is
# watched rather than silently rotting — the same failure mode this file
# exists to fix.
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/bump-agents-md-callers.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ jobs:
persist-credentials: false

- name: Generate Cloud Code Bot token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 — pinned: see dependabot.yml ignore (v2+ breaks cross-repo `owner:` token scoping)

@github-actions github-actions Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Low — The "do not upgrade" rationale lives in the trailing version comment, which is exactly the text Dependabot rewrites wholesale on a bump and pinact normalizes — the first permitted v1.x patch deletes the warning while the ignore silently stays in place. The free-form suffix also departs from the # vX.Y.Z form those tools parse. Put the guardrail somewhere automation will not erase. Raised by 2 of 8 reviewers (claude-opus-5-thinking-max adversarial, claude-opus-5-thinking-max edge-case).

id: token
with:
app-id: ${{ vars.APP_ID }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/bump-assign-reviewers-callers.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@ jobs:
persist-credentials: false

- name: Generate Cloud Code Bot token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 — pinned: see dependabot.yml ignore (v2+ breaks cross-repo `owner:` token scoping)
id: token
with:
app-id: ${{ vars.APP_ID }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/bump-auto-label-callers.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,7 +102,7 @@ jobs:
persist-credentials: false

- name: Generate Cloud Code Bot token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 — pinned: see dependabot.yml ignore (v2+ breaks cross-repo `owner:` token scoping)

@github-actions github-actions Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Medium — Reverting to v1.12.0 restores the widest token scope: with owner: set and repositories: empty, v1 mints an installation token valid for every repo the app is installed on in the org, carrying contents/pull-requests/issues write — which is the most likely reason v2+ 403s here. Least privilege is still reachable without hardcoding caller names: repositories: accepts an expression and can be fed from the same vars.AUTO_LABEL_CALLERS list the next step already consumes via CALLERS_JSON. Applies identically to all six bumper files. Raised by 2 of 8 reviewers (claude-opus-5-thinking-max adversarial, kimi-k2.7-code adversarial).

id: token
with:
app-id: ${{ vars.APP_ID }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/bump-cursor-review-callers.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,7 +83,7 @@ jobs:
persist-credentials: false

- name: Generate Cloud Code Bot token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 — pinned: see dependabot.yml ignore (v2+ breaks cross-repo `owner:` token scoping)
id: token
with:
app-id: ${{ vars.APP_ID }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/bump-groom-callers.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,7 @@ jobs:
persist-credentials: false

- name: Generate Cloud Code Bot token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 — pinned: see dependabot.yml ignore (v2+ breaks cross-repo `owner:` token scoping)
id: token
with:
app-id: ${{ vars.APP_ID }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/bump-pr-size-callers.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,7 @@ jobs:
persist-credentials: false

- name: Generate Cloud Code Bot token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 — pinned: see dependabot.yml ignore (v2+ breaks cross-repo `owner:` token scoping)
id: token
with:
app-id: ${{ vars.APP_ID }}
Expand Down
Loading