Skip to content

ci(repo): mint the release token from the GitHub App #66

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
arbianst merged 1 commit into from
Oct 30, 2026
Merged

ci(repo): mint the release token from the GitHub App #66

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 17 additions & 1 deletion .github/workflows/release-please.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,25 @@ jobs:
release-please:
if: github.repository == 'sentdm/sent-dm-python'
runs-on: ubuntu-latest
env:
HAS_APP: ${{ secrets.SDK_APP_ID != '' && secrets.SDK_APP_PRIVATE_KEY != '' }}

steps:
- name: Mint the release token from the GitHub App
# A tag or release created with the built-in token starts no
# workflow, so the publish workflow would never run; a personal
# access token expires or dies with its owner's account. The App's
# token does neither.
id: app
if: env.HAS_APP == 'true'
uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v3.3.0
with:
app-id: ${{ secrets.SDK_APP_ID }}
private-key: ${{ secrets.SDK_APP_PRIVATE_KEY }}
owner: sentdm
repositories: ${{ github.event.repository.name }}

@claude claude Bot Oct 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 This change's public commit history and PR text name a private Sent repository and an internal tracker, which customers of this public repo can see. Commit aa0af82 names the sent-dm-sdk-pipeline App and the "seal dispatch". The PR text also names sent-dm-sdk-pipeline, cites EPIC-4427, and gives an internal cause ("revoked with the other pipeline PATs"). Fix: reword the commit message and PR description without internal names, repositories or ticket IDs, e.g. "mint the release token from a GitHub App".

Why this was flagged

The commit message of aa0af82 says "The token now comes from the sent-dm-sdk-pipeline App, as the seal dispatch's already does". The PR description repeats sent-dm-sdk-pipeline, links the change to "EPIC-4427", and blames "the other pipeline PATs" revoked today. seal-dispatch.yml:48 shows that sent-dm-sdk-pipeline is a private Sent repository (repositories: sent-dm-sdk-pipeline). CLAUDE.md says: "This repository is public. Nothing in it, including PR text, CHANGELOG.md and release notes, links to or names Sent's private repositories, internal systems or providers." REVIEW.md classes such a name as Important. Once merged, the commit message stays in the public history of main for good, and the PR text stays public on GitHub. The base branch's history adds no new such names.

Verification: Commit aa0af82 says "The token now comes from the sent-dm-sdk-pipeline App, as the seal dispatch's already does". The PR description names sent-dm-sdk-pipeline and adds "Part of EPIC-4427". CLAUDE.md, under "Commits and pull requests", forbids naming Sent's private repositories or internal systems in PR text. The diff itself is clean.


- uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
id: release
with:
token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
token: ${{ steps.app.outputs.token || secrets.RELEASE_PLEASE_TOKEN }}
Comment on lines +15 to +36

@claude claude Bot Oct 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 The next SDK regeneration will conflict on this hand edit, and per CLAUDE.md that conflict blocks every SDK's release, not only this one. The release workflow is generator-owned, and HEAD aa0af82 has no Stainless-Generated-From trailer. The diff also rewrites the generator's token: line at :36, not only adding lines. CLAUDE.md: "Generator-owned, so don't edit them here: ... the publish, release and sync workflows". Fix: make the App-token change in the SDK configuration so it arrives in a generated commit, rather than editing release-please.yml on a feature branch.

Why this was flagged

This PR hand-edits .github/workflows/release-please.yml in commit aa0af82, whose message has no Stainless-Generated-From trailer. CLAUDE.md lists "the publish, release and sync workflows" as generator-owned. REVIEW.md says a change to one outside a generated commit is reported as Important. Besides adding the env block and the app step (lines 15-32), the diff changes the existing generated line token: ${{ secrets.RELEASE_PLEASE_TOKEN }} to token: ${{ steps.app.outputs.token || secrets.RELEASE_PLEASE_TOKEN }} (line 36). CLAUDE.md warns that changing lines the generator writes "conflicts the next time the API document changes, and a conflict blocks every SDK's release". On the base branch the file matches generator output, so regeneration applies cleanly. After merge, the next generated commit either conflicts and stalls all SDK releases, or overwrites the file and quietly brings back the revoked-PAT token line.

Verification: CLAUDE.md lists the release workflow as generator-owned: "The next generated commit rewrites them, and an edit conflicts." Commit aa0af82 has no Stainless-Generated-From trailer. At .github/workflows/release-please.yml:36 it replaces the existing token: ${{ secrets.RELEASE_PLEASE_TOKEN }} with token: ${{ steps.app.outputs.token || secrets.RELEASE_PLEASE_TOKEN }}.

Loading