Missing APP_ID / APP_PRIVATE_KEY secrets — dependabot-rebase workflow fails

Failure

The Dependabot update and merge workflow on main fails immediately at workflow validation:

Secret APP_ID is required, but not provided while calling.
Secret APP_PRIVATE_KEY is required, but not provided while calling.

Run: https://github.com/petry-projects/ContentTwin/actions/runs/24116570326

Cause

.github/workflows/dependabot-rebase.yml is the v1 stub from petry-projects/.github (adopted in #52). The reusable workflow declares both secrets as required so Dependabot rebases can be merged via a GitHub App token (not GITHUB_TOKEN), forming the self-sustaining merge chain. This repo doesn't have those secrets configured.

This is pre-existing — the inline version of the workflow had the same requirement. It was just silently failing the same way before the centralization PR landed.

Fix

Set both secrets at the repo level (or inherit from org-level secrets if you'd prefer to manage centrally):

gh secret set APP_ID --repo petry-projects/ContentTwin --body "<app-id>"
gh secret set APP_PRIVATE_KEY --repo petry-projects/ContentTwin --body "$(cat ~/.config/petry-app.pem)"

The GitHub App should have contents:write and pull-requests:write on this repo. See standards/dependabot-policy.md in petry-projects/.github.

Re-aiming this issue: org-level secrets, not repo-level

After review, the right fix is not to set APP_ID / APP_PRIVATE_KEY per-repo. The org currently has 4 repos that each carry their own copy of these secrets (broodly, google-app-scripts, markets, TalkTerm) — that's already drifty and brittle. ContentTwin (and bmad-bgreat-suite, where issue still applies) should inherit from the org level instead.

What needs to happen (org-wide, one-time)

Set the secrets at the org level with visibility: all:

gh secret set APP_ID --org petry-projects --visibility all --body "<github-app-id>"
gh secret set APP_PRIVATE_KEY --org petry-projects --visibility all --body "$(cat ~/.config/petry-app.pem)"

Verify ContentTwin's workflows pick them up automatically. No repo-level config change needed — secrets: inherit in the dependabot-rebase reusable caller already inherits from org-level secrets visible to the repo. Push an empty commit on main or wait for the next Dependabot run; the workflow that was failing on Secret APP_ID is required should now succeed.
(Optional cleanup) Delete the per-repo copies once the org-level secrets are in place:
```
for repo in broodly google-app-scripts markets TalkTerm; do
  gh secret delete APP_ID --repo petry-projects/$repo
  gh secret delete APP_PRIVATE_KEY --repo petry-projects/$repo
done
```
Per-repo secrets shadow org-level secrets, so until they're removed those 4 repos will keep using their local copies (which is fine — same value should be in both — but it's technical debt).

Why this is the right move

Single source of truth — the next repo we add gets working dependabot-rebase for free.
Centralized rotation — when the GitHub App's private key is rotated, one gh secret set updates every repo.
Matches the existing pattern — CLAUDE_CODE_OAUTH_TOKEN, GH_PAT_WORKFLOWS, SONAR_TOKEN, and ORG_SCORECARD_TOKEN are already org-level (visibility: all). APP_ID / APP_PRIVATE_KEY are the only odd ones out.

What's tracked here vs separately

This issue stays open as the ContentTwin-side ack — once the org secrets are set and ContentTwin's next dependabot-rebase run is green, close it. combsmith/bmad-bgreat-suite#79 will be repurposed (the dependabot-rebase.yml will be deleted there since bmad doesn't have strict status checks, so org-level secrets aren't strictly needed for it — but they're still good hygiene).

docs(dependabot-policy): App secrets at org level + skip rebase if no…

docs(dependabot): App secrets at org level + rebase workflow optional…

Resolved! This check is now passing as of 2026-04-09. Closing automatically.

docs(dependabot): App secrets at org level + rebase workflow optional…

Navigation Menu

Repository navigation

Missing APP_ID / APP_PRIVATE_KEY secrets — dependabot-rebase workflow fails #53

Failure

Cause

Fix

Re-aiming this issue: org-level secrets, not repo-level

What needs to happen (org-wide, one-time)

Why this is the right move

What's tracked here vs separately

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Missing APP_ID / APP_PRIVATE_KEY secrets — dependabot-rebase workflow fails #53

Description

Failure

Cause

Fix

Activity

don-petry commented on Apr 8, 2026

Re-aiming this issue: org-level secrets, not repo-level

What needs to happen (org-wide, one-time)

Why this is the right move

What's tracked here vs separately

don-petry commented on Apr 9, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions