From 7bec23410dcef1e1e030f60041240456a1e272d9 Mon Sep 17 00:00:00 2001
From: Altay <altay@hey.com>
Date: Thu, 20 Aug 2026 06:45:14 +0300
Subject: [PATCH] ci: gate lockfile maintenance on main, release environment,
 read scope
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- run only on refs/heads/main: a workflow_dispatch from another ref
  would force-push the maintenance branch from a stale base
- environment: release — PUTIO_RELEASE_BOT_CLIENT_ID and the App
  private key are environment-scoped; the first dispatch failed to
  mint a token without it (taizn actions run 32328993072)
- job-level contents: read for checkout, matching the house baseline
- align the bot identity lookup with the fleet-majority form
  (%5Bbot%5D path, user_id output)

Refs putdotio/putio-frontend#29

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/lockfile-maintenance.yml | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/lockfile-maintenance.yml b/.github/workflows/lockfile-maintenance.yml
index a226482..05b4c4d 100644
--- a/.github/workflows/lockfile-maintenance.yml
+++ b/.github/workflows/lockfile-maintenance.yml
@@ -16,11 +16,18 @@ permissions: {}
 jobs:
   refresh:
     name: Refresh lockfile
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     concurrency:
       group: lockfile-maintenance-${{ github.repository }}
       cancel-in-progress: false
+    environment:
+      name: release
+      deployment: false
+    permissions:
+      contents: read
+
     steps:
       - name: Create release bot token
         id: release-bot
@@ -38,12 +45,12 @@ jobs:
           APP_SLUG: ${{ steps.release-bot.outputs.app-slug }}
         run: |
           set -euo pipefail
-          user_id="$(gh api "/users/${APP_SLUG}[bot]" --jq .id)"
+          user_id="$(gh api "/users/${APP_SLUG}%5Bbot%5D" --jq .id)"
           if [[ ! "$user_id" =~ ^[0-9]+$ ]]; then
             echo "failed to resolve numeric bot user id for ${APP_SLUG}[bot]" >&2
             exit 1
           fi
-          echo "user-id=${user_id}" >> "$GITHUB_OUTPUT"
+          echo "user_id=${user_id}" >> "$GITHUB_OUTPUT"
 
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -62,7 +69,7 @@ jobs:
         env:
           GH_TOKEN: ${{ steps.release-bot.outputs.token }}
           APP_SLUG: ${{ steps.release-bot.outputs.app-slug }}
-          BOT_USER_ID: ${{ steps.release-bot-identity.outputs.user-id }}
+          BOT_USER_ID: ${{ steps.release-bot-identity.outputs.user_id }}
         run: |
           set -euo pipefail
           if git diff --quiet -- pnpm-lock.yaml; then