Use GitHub App for vpm.json updates - #5
Conversation
Up to standards ✅🟢 Issues
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6391ab18a4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Pull request overview
This PR updates the VPM writer workflows to use a repository-scoped GitHub App installation token (instead of the workflow GITHUB_TOKEN) for checkout and direct pushes to master, and documents the required GitHub App setup.
Changes:
- Reduced workflow
GITHUB_TOKENpermissions tocontents: readand introducedactions/create-github-app-tokento mint acontents: writeinstallation token for pushes. - Updated git commit identity in both writer workflows to use the GitHub App bot name/email.
- Updated README to document the GitHub App configuration expected for both repositories.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| README.md | Documents the required GitHub App configuration and how the writer workflows authenticate/push. |
| .github/workflows/update-vpm.yml | Uses a GitHub App installation token for checkout/push and sets commit identity for vpm.json updates. |
| .github/workflows/sync-vpm-yanks.yml | Uses a GitHub App installation token for checkout/push and sets commit identity for yank synchronization updates. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
The proposed changes align with the goal of using GitHub App identities and improving security by reducing default GITHUB_TOKEN permissions. Codacy analysis indicates the code is up to standards. The primary issue to address is a discrepancy in bot identity configuration between the two modified workflows. While one workflow correctly resolves the App's numeric ID for commit attribution, the other uses an incomplete format. This inconsistency will lead to unverified commits and fragmented repository history. Resolving this will ensure a clean, professional commit trail.
About this PR
- There is a systemic inconsistency in how the bot identity is resolved. Workflow 2 (release listing) correctly resolves the bot's numeric user ID via the GitHub API to construct a standard noreply email, whereas Workflow 1 (yank sync) uses a simplified hardcoded format. This will result in inconsistent commit attribution metadata across the repository history.
1 comment outside of the diff
[REDACTED:HIGH_ENTROPY]
line 96🟡 MEDIUM RISK
Suggestion: This workflow constructs the bot's email address without the required numeric user ID prefix ('ID+login[bot]@users.noreply.github.com'), which is inconsistent with the implementation in the other modified workflow. This prevents GitHub from correctly attributing the commit to the App and displaying the 'Verified' badge.To ensure consistency, add a step to resolve the identity via the API:
gh api "users/${APP_SLUG}[bot]" --jq ".id"and use that ID to format the user.email.
Test suggestions
- Verify that the GitHub App token is successfully generated with 'permission-contents: write' and utilized by the checkout action.
- Verify that the git commit identity (name and email) is correctly configured as the App bot before pushing.
- Verify that the GITHUB_TOKEN permission is explicitly set to read-only for contents.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify that the GitHub App token is successfully generated with 'permission-contents: write' and utilized by the checkout action.
2. Verify that the git commit identity (name and email) is correctly configured as the App bot before pushing.
3. Verify that the GITHUB_TOKEN permission is explicitly set to read-only for contents.
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
There was a problem hiding this comment.
Pull Request Overview
While this PR moves toward a more secure GitHub App authentication model, it contains functional blockers and configuration errors that will prevent the workflows from running successfully. Specifically, the API calls to resolve bot identity will fail with 400 errors due to unencoded square brackets in the URL path. Additionally, the token generation step uses an incorrect input key ('permission-contents') which is not recognized by the official action.
Furthermore, there is a gap in meeting the acceptance criteria: the required documentation for the new secrets (APP_CLIENT_ID, APP_PRIVATE_KEY) and App permissions has not been added to the README. These issues must be addressed before the PR is ready for merging.
About this PR
- The acceptance criteria require documenting the newly introduced secrets (APP_CLIENT_ID, APP_PRIVATE_KEY) and the specific GitHub App permissions in the README. This documentation is currently missing from the PR.
4 comments outside of the diff
[REDACTED:HIGH_ENTROPY]
line 54🟡 MEDIUM RISK
The input 'permission-contents' is likely incorrect for the 'actions/create-github-app-token' action. It typically expects permissions to be defined under the 'permissions' key.Try running the following prompt in your IDE agent:
In this GitHub Action workflow, replace the 'permission-contents: write' input for the 'app-token' step with 'permissions: { "contents": "write" }'.
line 58-65🔴 HIGH RISK
Thegh apicall will fail due to unencoded square brackets in the URL path. You can simplify this and improve robustness by querying the authenticated user identity directly from the token, which avoids manual string construction, encoding issues, and unused environment variables.env: GH_TOKEN: ${{ steps.app-token.outputs.token }} run: | gh api user --jq '"name=\(.login)", "email=\(.id)+\(.login)@users.noreply.github.com"' >> "$GITHUB_OUTPUT"
line 81🟡 MEDIUM RISK
The input 'permission-contents' is likely incorrect for the 'actions/create-github-app-token' action. It typically expects permissions to be defined under the 'permissions' key.Try running the following prompt in your IDE agent:
In this GitHub Action workflow, replace the 'permission-contents: write' input for the 'app-token' step with 'permissions: { "contents": "write" }'.
line 85-92🔴 HIGH RISK
Thegh apicall will fail due to unencoded square brackets in the URL path. You can simplify this and improve robustness by querying the authenticated user identity directly from the token, which avoids manual string construction, encoding issues, and unused environment variables.env: GH_TOKEN: ${{ steps.app-token.outputs.token }} run: | gh api user --jq '"name=\(.login)", "email=\(.id)+\(.login)@users.noreply.github.com"' >> "$GITHUB_OUTPUT"
Test suggestions
- Verify GitHub App token generation using client ID and private key secrets.
- Verify resolution of GitHub App bot name and ID-based email via GitHub API.
- Verify checkout step successfully utilizes the App token for repository access.
- Verify Git configuration and push logic use the resolved bot identity and token for authentication.
- Confirm default GITHUB_TOKEN permissions are restricted to read-only in the workflow definition.
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
Summary
mastervpm.jsonchanges under the GitHub App bot identityGITHUB_TOKENpermission to read-onlyWhy
The receiver previously wrote
vpm.jsonwith the workflowGITHUB_TOKENandgithub-actions[bot]. This change makes the publishing identity explicit and routes both release additions and yank synchronization through the installed GitHub App.Validation
master; only the two writer workflows and README changedmasterRequired repository configuration
Penguin-Repository/VPM-Repositorymust exposeAPP_CLIENT_IDandAPP_PRIVATE_KEY, and the App installation must grantContents: Read and writefor this repository.