Repository navigation
Create a GitHub App for board writes, and board sweep-filed issues from the workflows #5061
Description
Problem
The issue-filing sweeps added by #4874 (dependency-refresh, dependabot-alerts, sdk-watch) file labeled, milestoned issues but cannot put them on the Servers V2 board (#43). Board #43 is an org project, so writing a card needs organization projects: write, and a workflow's GITHUB_TOKEN cannot hold that permission (permissions: has no key for it). Today every sweep-filed issue waits for a maintainer to run /issue-triage, whose pass 1 moves an unboarded, milestoned issue into Todo.
The Inspector hit the same wall. Its alert sweep shipped board-write code that read a PROJECT_TOKEN secret that was never created, so the code never ran (modelcontextprotocol/inspector#2547). It is now moving all board automation onto one GitHub App credential (modelcontextprotocol/inspector#2543, #2544). #4874 deliberately ships no board-write code, so nothing here reads a secret that does not exist.
What to create
A GitHub App installed on the modelcontextprotocol org, on the servers repository only. It is only an identity with permissions, with no code and no server. Workflows mint a short-lived installation token from it on each run with actions/create-github-app-token, pinned to a commit SHA.
| Scope | Permission | Needed by |
|---|---|---|
| Organization | Projects: read & write | placing each sweep-filed issue on #43 with Status and Priority |
| Repository | Issues: read & write | filing and commenting, if the sweeps move onto the App identity |
| Repository | Dependabot alerts: read | dependabot-alerts (optional: vulnerability-alerts: read already works on GITHUB_TOKEN) |
| Repository | Administration: read (optional) | turns the alert sweep's automated-security-fixes check from UNVERIFIED into a real assertion |
Grant nothing beyond that list: no Contents write, no Workflows, no Secrets.
The App id and private key go in org Actions secrets limited to servers. Record the names in AGENTS.md next to the sweep rules.
Creating and installing the App is an org-admin act and stays human-gated. An agent cannot do it.
Then
Once the App exists, teach the sweeps to board what they file: the alert sweep at Todo / High, and the monthly refresh and SDK watch at Todo with a rubric-scored Priority. Resolve option ids by name at run time (the board-ops hazard). Keep the triage hand-off as the fallback when the secret is absent, so a run without it still files and stays green. The App's job also counts as credentialed for verify:action-pins.
Acceptance
- App created and installed on
serversonly, with exactly the permissions above - App id and private key stored as org Actions secrets limited to
servers, and their names recorded inAGENTS.md - A dispatched run mints a token and reads board Initial GitLab server version #43
- Each sweep boards the issues it files, and degrades to the triage hand-off without the secret
Activity
Replace Dependabot PRs with issue-filing sweeps; add the SDK watch an…