Migrate App-token to client-id and drop inert codegen PR base filter - #90
Merged
Conversation
actions/create-github-app-token deprecated the numeric `app-id` input in v3.0.0 (2026-03-14) in favor of `client-id`. Closes #88: bumps the SHA pin from v1.12.0 to v3.2.0 across all four call sites; renames secret CODEGEN_APP_ID -> CODEGEN_APP_CLIENT_ID; updates README setup guidance to point at the App's Client ID (different identifier than the numeric App ID, both shown on the App settings page); adds an AGENTS.md note so future App-token call sites don't reintroduce the deprecated name. Maintainers must add the new CODEGEN_APP_CLIENT_ID secret in both Actions and Dependabot stores before merging; the old CODEGEN_APP_ID secret can be deleted after one green run of each bot workflow. Closes #89: drops `codegen` from `test-pull-request.yml`'s `pull_request.branches` filter. The filter matches the PR's base ref, not the head — no PR in this repo ever targets a `codegen` base (codegen PRs target main/develop with head refs `codegen-main`/`codegen-develop`), so the entry was inert and misleading.
Replaces the absolute "agents never commit" rule with a scope-bound
authorization model: agents may run `git commit` when the developer
explicitly asks ("commit this", "open a PR", etc.) AND the environment
has signing wired up (commit.gpgsign true, user.signingkey set, and a
working ssh-agent or gpg-agent). Without that configuration, agents
still stop at `git add` and surface the missing config — branch
protection rejects unsigned commits, so attempting one would just
fail the push.
The "never force push" and "never run destructive git commands"
absolutes are unchanged.
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the template’s GitHub Actions automation and documentation to align with the latest actions/create-github-app-token inputs (Client ID) and to remove an ineffective PR base-branch filter, while clarifying agent commit/signing guidance in AGENTS.md.
Changes:
- Migrate GitHub App token generation from deprecated
app-idtoclient-id, including secret rename toCODEGEN_APP_CLIENT_ID, and update documentation accordingly. - Remove the inert
codegenentry fromtest-pull-request.yml’spull_request.branchesfilter (since it filters on PR base branch). - Refine
AGENTS.mdguidance to allow agent commits only when explicitly authorized and commit signing is correctly configured.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| README.md | Updates GitHub App setup instructions to use Client ID (CODEGEN_APP_CLIENT_ID) and clarifies the identifier difference. |
| AGENTS.md | Revises commit/signing rules to be authorization- and environment-dependent; documents Client ID usage for App-token workflows. |
| .github/workflows/test-pull-request.yml | Removes the ineffective codegen PR base-branch filter entry. |
| .github/workflows/run-codegen-pull-request-task.yml | Updates actions/create-github-app-token pin and switches to client-id + new secret name in reusable workflow. |
| .github/workflows/merge-bot-pull-request.yml | Updates all App-token generation steps to v3.2.0 SHA pin and switches to client-id + new secret name. |
4 tasks
ptr727
added a commit
that referenced
this pull request
May 25, 2026
…90) (#91) ## Summary Promotes develop → main. Two squashed commits ride along: - **PR #90** — Migrate `actions/create-github-app-token` from deprecated `app-id` to `client-id` (closes #88), bump pin `v1.12.0` → `v3.2.0`, drop inert `codegen` entry from `test-pull-request.yml`'s base-branch filter (closes #89), and relax `AGENTS.md`'s "agents never commit" rule to allow scope-bound, signing-gated authorization. 5 files, 16+/17-. - **PR #86** — `[ptr727-codegen]` weekly codegen refresh; 1 line in `CodeGen/CodeGen.cs`. The `CODEGEN_APP_CLIENT_ID` secret is already provisioned in both Actions and Dependabot stores. The legacy `CODEGEN_APP_ID` secret can be deleted after one round of each bot workflow runs green on main post-merge. ## Test plan - [ ] CI green on this PR. - [ ] Post-merge: trigger `run-periodic-codegen-pull-request.yml` via `workflow_dispatch`; both matrix legs (main, develop) mint App tokens and open codegen PRs as `ptr727-codegen[bot]`. - [ ] Post-merge: next Dependabot PR auto-merges cleanly via `merge-bot-pull-request.yml` `merge-dependabot`. - [ ] After one green round of each bot workflow, delete legacy `CODEGEN_APP_ID` secret from both Actions and Dependabot stores.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bundles two GitHub-Actions hygiene fixes:
actions/create-github-app-tokendeprecated the numericapp-idinput in v3.0.0 (2026-03-14) in favor ofclient-id. Bumps the SHA pin fromv1.12.0→v3.2.0across all four call sites, renames secretCODEGEN_APP_ID→CODEGEN_APP_CLIENT_ID, and reworks README setup guidance to point at the App's Client ID (a different identifier than the numeric App ID — both are visible on the App settings page).codegenfromtest-pull-request.yml'spull_request.branchesfilter. The filter matches the PR's base ref, not the head; no PR in this repo targets acodegenbase (codegen PRs targetmain/developwith head refscodegen-main/codegen-develop), so the entry was inert.Also opportunistically replaces the absolute "agents never commit" rule in
AGENTS.mdwith a scope-bound authorization model: agents may commit when explicitly asked and signing is configured in the environment; without signing wired up they still stop atgit add. Branch protection's signed-commit requirement is unchanged — unsigned commits are rejected on push regardless.Pre-merge maintainer step
The
CODEGEN_APP_CLIENT_IDsecret must exist in both the Actions and Dependabot secret stores before merging (already provisioned). The legacyCODEGEN_APP_IDsecret should be left in place until one round of each bot workflow runs green post-merge, then deleted.Test plan
Check pull request workflow status).run-periodic-codegen-pull-request.ymlviaworkflow_dispatch; both matrix legs (main,develop) generate an App token, open a codegen PR asptr727-codegen[bot], and auto-merge.merge-bot-pull-request.ymlmerge-dependabotcleanly.disable-auto-merge-on-maintainer-pushjob still fires when a maintainer pushes to a bot PR (next-time-it-happens check).CODEGEN_APP_IDsecret from both Actions and Dependabot stores.