ci: actions/create-github-app-token -> v3 - #8240
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. 3 Skipped Deployments
|
📝 WalkthroughWalkthroughThe workflow updates Estimated code review effort: 1 (Trivial) | ~2 minutes Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Docker builds report
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: f4e8f758-6523-4044-b3a3-b3d01a998c91
📒 Files selected for processing (1)
.github/workflows/api-fix-docs-artefacts.yml
| - name: Generate GitHub App token with push access | ||
| id: app-token | ||
| uses: actions/create-github-app-token@v1 | ||
| uses: actions/create-github-app-token@v3 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow excerpts =="
sed -n '1,120p' .github/workflows/api-fix-docs-artefacts.yml 2>/dev/null || true
echo
sed -n '1,60p' .github/workflows/renovate.yml 2>/dev/null || true
echo
echo "== create-github-app-token references =="
rg -n "actions/create-github-app-token|create-github-app-token|client-id|permissions:|github-app-token" .github/workflows .github 2>/dev/null || trueRepository: Flagsmith/flagsmith
Length of output: 7615
🌐 Web query:
actions create-github-app-token v3 input client-id permissions
💡 Result:
In version 3 of the actions/create-github-app-token GitHub Action, the client-id input is the recommended way to identify your GitHub App, replacing the legacy app-id input [1][2][3]. The action also provides granular control over the permissions granted to the generated token through dynamically defined permission- inputs [4][5][6]. Key details regarding these inputs include: client-id This is a required input used to specify the GitHub App's Client ID [1][2]. While the legacy app-id input is still supported for backward compatibility, it is deprecated in favor of client-id [1][3][7]. If both are provided, client-id takes precedence [3]. Permission Inputs (permission-) The action supports granular control over the GitHub API scopes granted to the resulting installation access token [4][5]. - Usage: You can explicitly list required permissions by prefixing the permission name with permission- (e.g., permission-pull-requests for pull_requests) [1][4]. - Default Behavior: If no permission- inputs are provided, the generated token inherits all permissions currently granted to the GitHub App installation [1][4][5]. - Security Recommendation: It is considered a security best practice to explicitly list only the permissions necessary for your specific use case to follow the principle of least privilege [1][7]. - Validation: When setting these permissions, ensure they are granted to the specific app installation; requesting a permission that the installation does not possess will result in an error [1][5]. - Values: Generally, these inputs accept read or write, and in some cases, admin [5][6]. Example usage: - uses: actions/create-github-app-token@v3 with: client-id: ${{ vars.GITHUB_APP_CLIENT_ID }} private-key: ${{ secrets.GITHUB_APP_PRIVATE_KEY }} permission-contents: read permission-pull-requests: write
Citations:
- 1: https://github.com/actions/create-github-app-token/blob/main/README.md
- 2: actions/create-github-app-token@v2.2.2...v3
- 3: feat: add
client-idinput and deprecateapp-idactions/create-github-app-token#353 - 4: https://deepwiki.com/actions/create-github-app-token/4.2-permission-system
- 5: https://deepwiki.com/actions/create-github-app-token/4.1-action-inputs
- 6: https://github.com/actions/create-github-app-token/blob/29824e69f54612133e76f7eaac726eef6c875baf/action.yml
- 7: https://deepwiki.com/actions/create-github-app-token/2-getting-started
🌐 Web query:
actions create-github-app-token bcd2ba49218906704ab6c1aa796996da409d3eb1
💡 Result:
The string bcd2ba49218906704ab6c1aa796996da409d3eb1 is the specific git commit hash corresponding to version 3.2.0 of the official actions/create-github-app-token GitHub Action [1][2]. This action is an official GitHub-owned tool used to generate installation access tokens for GitHub Apps within a GitHub Actions workflow [3][4]. It allows workflows to authenticate and perform API requests on behalf of a GitHub App by exchanging the app's credentials (typically a client ID and private key stored in repository secrets/variables) for a temporary, short-lived installation access token [3][5][6]. Key details about this version and the action: - Purpose: Enables secure, authenticated API interactions by GitHub Apps within CI/CD pipelines [4][5]. - Version 3.2.0: This release was published on May 12, 2026 [7]. The specific commit hash bcd2ba49218906704ab6c1aa796996da409d3eb1 is frequently used in workflow configurations to pin the dependency to this specific release for stability [1][2]. - Functionality: It supports various scoping options (e.g., enterprise, owner, or specific repositories), automatically masks generated tokens in logs, and includes a post-job execution phase to revoke the token by default for enhanced security [3][5][6].
Citations:
- 1: microsoft/GitHub-Copilot-for-Azure@8e60bda
- 2: gastownhall/beads@f18daea
- 3: https://github.com/actions/create-github-app-token
- 4: https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/making-authenticated-api-requests-with-a-github-app-in-a-github-actions-workflow
- 5: https://deepwiki.com/actions/create-github-app-token/2-getting-started
- 6: https://deepwiki.com/actions/create-github-app-token/3.1-token-generation-process
- 7: https://github.com/actions/create-github-app-token/releases
Pin actions/create-github-app-token to the full commit SHA.
api-fix-docs-artefacts.yml still uses the mutable @v3 tag, while renovate.yml already uses bc d2ba49218906704ab6c1aa796996da409d3eb1. Pin the reference to avoid unintended action code drift, unless FLAGSMITH_ENGINEERING_GH_APP_ID must stay as an App ID rather than a Client ID; if it does, client-id needs to be replaced before pinning.
🧰 Tools
🪛 actionlint (1.7.12)
[error] 31-31: missing input "app-id" which is required by action "actions/create-github-app-token@v3". all required inputs are "app-id", "private-key"
(action)
🪛 zizmor (1.29.0)
[error] 31-31: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 31-31: dangerous use of GitHub App tokens (github-app): app token inherits blanket installation permissions
(github-app)
Source: Linters/SAST tools
| uses: actions/create-github-app-token@v3 | ||
| with: | ||
| app-id: ${{ vars.FLAGSMITH_ENGINEERING_GH_APP_ID }} | ||
| client-id: ${{ vars.FLAGSMITH_ENGINEERING_GH_APP_ID }} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow files matching api-fix-docs-artefacts =="
fd -a 'api-fix-docs-artefacts\.ya?ml$' .github/workflows || true
echo "== target file excerpt =="
if [ -f .github/workflows/api-fix-docs-artefacts.yml ]; then
cat -n .github/workflows/api-fix-docs-artefacts.yml | sed -n '1,110p'
fi
echo "== action ref occurrences =="
rg -n "create-github-app-token|actions/checkout|git push|permission-contents|install-id|client-id|private-key" .github/workflows/api-fix-docs-artefacts.yml .github/workflows 2>/dev/null || true
echo "== git status/stat =="
git diff --stat || trueRepository: Flagsmith/flagsmith
Length of output: 6599
🌐 Web query:
actions/create-github-app-token v3 permission-contents input inheritance default permissions
💡 Result:
The actions/create-github-app-token action uses an inheritance-based model for permissions [1][2]. By default, if no specific permission-* inputs are provided, the generated GitHub App installation token inherits all permissions currently granted to the GitHub App installation [1][3][4]. When you explicitly provide permission-* inputs (such as permission-contents), you are overriding this default behavior [3][5]. In this case, the token will only be granted the specific permissions you have explicitly defined in the workflow step, rather than the full set of permissions associated with the installation [3][5]. Key points regarding this behavior: - Inheritance: Without explicit permission inputs, the token receives the full scope of the installation's permissions [1][4]. - Explicit Configuration: If you define even one permission-* input, you effectively switch to a restricted mode where only the specified permissions are applied [3][5]. - Best Practice: It is recommended to explicitly list only the permissions required for your specific use case to follow the principle of least privilege [1][3][6]. - Validation: You must ensure that any permission requested via permission-* inputs has been granted to the GitHub App installation itself; otherwise, the action will fail [1][4][6]. Source documentation confirms that this mechanism remains consistent in version 3, which continues to support these granular permission inputs to provide fine-grained access control [1][7].
Citations:
- 1: https://github.com/actions/create-github-app-token
- 2: https://github.com/actions/create-github-app-token?tab=readme-ov-file
- 3: https://deepwiki.com/actions/create-github-app-token/4.2-permission-system
- 4: https://deepwiki.com/actions/create-github-app-token/4.1-action-inputs
- 5: Changes in permission-* handling since version 2.0.4 actions/create-github-app-token#248
- 6: https://github.com/marketplace/actions/create-github-app-token
- 7: actions/create-github-app-token@v2.2.2...v3
Restrict the generated token to repository contents.
actions/create-github-app-token gives all installation permissions by default unless a permission-* input is provided. Since this token is only used for checkout and push, add only permission-contents: write.
Proposed fix
with:
client-id: ${{ vars.FLAGSMITH_ENGINEERING_GH_APP_ID }}
private-key: ${{ secrets.FLAGSMITH_ENGINEERING_GH_APP_PRIVATE_KEY }}
+ permission-contents: write🧰 Tools
🪛 actionlint (1.7.12)
[error] 31-31: missing input "app-id" which is required by action "actions/create-github-app-token@v3". all required inputs are "app-id", "private-key"
(action)
[error] 33-33: input "client-id" is not defined in action "actions/create-github-app-token@v3". available inputs are "app-id", "github-api-url", "owner", "permission-actions", "permission-administration", "permission-checks", "permission-codespaces", "permission-contents", "permission-custom-properties-for-organizations", "permission-dependabot-secrets", "permission-deployments", "permission-email-addresses", "permission-enterprise-custom-properties-for-organizations", "permission-environments", "permission-followers", "permission-git-ssh-keys", "permission-gpg-keys", "permission-interaction-limits", "permission-issues", "permission-members", "permission-metadata", "permission-organization-administration", "permission-organization-announcement-banners", "permission-organization-copilot-seat-management", "permission-organization-custom-org-roles", "permission-organization-custom-properties", "permission-organization-custom-roles", "permission-organization-events", "permission-organization-hooks", "permission-organization-packages", "permission-organization-personal-access-token-requests", "permission-organization-personal-access-tokens", "permission-organization-plan", "permission-organization-projects", "permission-organization-secrets", "permission-organization-self-hosted-runners", "permission-organization-user-blocking", "permission-packages", "permission-pages", "permission-profile", "permission-pull-requests", "permission-repository-custom-properties", "permission-repository-hooks", "permission-repository-projects", "permission-secret-scanning-alerts", "permission-secrets", "permission-security-events", "permission-single-file", "permission-starring", "permission-statuses", "permission-team-discussions", "permission-vulnerability-alerts", "permission-workflows", "private-key", "repositories", "skip-token-revoke"
(action)
🪛 zizmor (1.29.0)
[error] 31-31: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 31-31: dangerous use of GitHub App tokens (github-app): app token inherits blanket installation permissions
(github-app)
Source: Linters/SAST tools
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #8240 +/- ##
==========================================
+ Coverage 98.71% 98.72% +0.01%
==========================================
Files 1531 1543 +12
Lines 61263 61805 +542
==========================================
+ Hits 60475 61017 +542
Misses 788 788 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
✅ private-cloud · depot-ubuntu-latest-arm-16 — run #19101 (attempt 1)Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)
Details
🗂️ Previous results✅ oss · depot-ubuntu-latest-arm-16 — run #19101 (attempt 1)Playwright Test Results (oss - depot-ubuntu-latest-arm-16)
Details
✅ private-cloud · depot-ubuntu-latest-16 — run #19101 (attempt 1)Playwright Test Results (private-cloud - depot-ubuntu-latest-16)
Details
✅ oss · depot-ubuntu-latest-16 — run #19101 (attempt 1)Playwright Test Results (oss - depot-ubuntu-latest-16)
Details
|
Visual Regression19 screenshots compared. See report for details. |
1 participant
Thanks for submitting a PR! Please check the boxes below:
docs/if required so people know about the feature.Changes
Updates
actions/create-github-app-tokento v3 to resolve current failures in our CI workflows based on Node 20 usage.How did you test this code?
CI against this PR should prove if it's successful or not.