Skip to content

ci(workflows): pass the App's client-id to create-github-app-token, pinned at v3.3.0 #81

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
arbianst merged 1 commit into from
Nov 10, 2026
Merged

ci(workflows): pass the App's client-id to create-github-app-token, pinned at v3.3.0 #81

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/release-please.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,9 +23,9 @@ jobs:
# token does neither.
id: app
if: env.HAS_APP == 'true'
uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v3.3.0
uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
with:
app-id: ${{ secrets.SDK_APP_ID }}
client-id: ${{ secrets.SDK_APP_ID }}
Comment on lines +26 to +28

@claude claude Bot Nov 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Maintainers lose this edit on the next regeneration, or every SDK's release is blocked by a conflict. release-please.yml is the release workflow, which the generator owns. This commit edits it by hand, with no Stainless-Generated-From trailer. CLAUDE.md says: "Generator-owned, so don't edit them here: ... the publish, release and sync workflows". Fix: make the client-id rename and the SHA re-pin in the generator's workflow template, then let a generated commit carry it here. seal-dispatch.yml calls itself custom code and can stay as a hand edit.

Why this was flagged

Commit 553cf47 changes .github/workflows/release-please.yml:26-28 and has no Stainless-Generated-From trailer. CLAUDE.md:19-22 lists "the publish, release and sync workflows" as generator-owned and says "The next generated commit rewrites them, and an edit conflicts." CLAUDE.md:38-41 says changing generator-written lines "conflicts the next time the API document changes, and a conflict blocks every SDK's release". REVIEW.md says to report as Important any change to a generator-owned file made outside a generated commit. On base, this file matches what the pipeline last produced, so there is no conflict. After this merge, either the next regeneration overwrites client-id and the pin and brings back app-id and the old SHA, or the pipeline's patch carry-forward conflicts. The earlier hand edit aa0af82 has no trailer either; that is precedent, not permission. seal-dispatch.yml:12-14 says that workflow is custom code, so this finding covers only release-please.yml.

Verification: The trigger is the next generated commit that rewrites the release workflow. .github/workflows/release-please.yml is the release workflow, created by generated commit f3a283b. Commit 553cf47 edits lines 26-28 with no Stainless-Generated-From trailer. The edited lines come from hand commit aa0af82, so this risk already exists on the base.

private-key: ${{ secrets.SDK_APP_PRIVATE_KEY }}
owner: sentdm
repositories: ${{ github.event.repository.name }}
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/seal-dispatch.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,9 +40,9 @@ jobs:
- name: Mint a pipeline token from the GitHub App
id: app
if: env.HAS_APP == 'true'
uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v3.3.0
uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
with:
app-id: ${{ secrets.SDK_APP_ID }}
client-id: ${{ secrets.SDK_APP_ID }}
Comment on lines +43 to +45

@claude claude Bot Nov 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 The PR description names an internal org, sent-dm-agentic-org, in this public repository. CLAUDE.md forbids naming Sent's internal systems in PR text. The rule: "Nothing in it, including PR text, ... links to or names Sent's private repositories, internal systems or providers." The text also gives internal rollout details ("33 repositories, 61 workflow files") that customers cannot see. Fix: remove the org name and the cross-repo rollout sentence from the PR description, and keep it about this repository's workflows.

Why this was flagged

The PR description ends with "Same change across every sentdm repository that mints an App token (33 repositories, 61 workflow files), from sent-dm-agentic-org." CLAUDE.md:94-97 says the repository is public and that nothing in it, including PR text, links to or names Sent's private repositories or internal systems. REVIEW.md lists the name of a private Sent repository or internal system as an Important finding. Before this PR, no PR text named this org. Once the PR is opened or merged, the name is public on the repository's PR history. The diff's existing context line naming sent-dm-sdk-pipeline (seal-dispatch.yml:48) is unchanged, so this finding covers only the new PR text.

Verification: Trigger: the description is published as written on a public repository. The PR description ends with "Same change across every sentdm repository that mints an App token (33 repositories, 61 workflow files), from sent-dm-agentic-org." That names the internal automation org/repository that rolled the change out. Nothing in this public checkout mentions it.

private-key: ${{ secrets.SDK_APP_PRIVATE_KEY }}
owner: sentdm
repositories: sent-dm-sdk-pipeline
Expand Down
Loading