From d0bd98d25a5060a7cbff3abdacc60d234353f942 Mon Sep 17 00:00:00 2001 From: Taylor Buchanan Date: Sat, 8 Aug 2026 16:24:31 -0500 Subject: [PATCH] Use client-id in CD's GitHub App token step `app-id` is deprecated in actions/create-github-app-token, so every CD Version run gets annotated with a warning pointing at `client-id`. The rename is input-only: the action reads `client-id || app-id` with no format validation and passes the value through as the JWT `iss` claim, which GitHub documents as accepting either a client ID or an application ID. The existing APP_ID variable keeps working, so neither this repo nor a consumer of the reusable workflow has to reprovision anything. actionlint's bundled action database predates create-github-app-token v3.1.0, which added `client-id`, so it reads the corrected step as both missing a required input and using an unknown one. Ignore those two messages for cd.yml to keep the branch green; the file comes back out once an actionlint release refreshes that entry. Co-Authored-By: Claude Opus 5 (1M context) --- .changeset/app-token-client-id.md | 4 ++++ .github/actionlint.yaml | 11 +++++++++++ .github/workflows/cd.yml | 4 +++- AGENTS.md | 1 + 4 files changed, 19 insertions(+), 1 deletion(-) create mode 100644 .changeset/app-token-client-id.md create mode 100644 .github/actionlint.yaml diff --git a/.changeset/app-token-client-id.md b/.changeset/app-token-client-id.md new file mode 100644 index 0000000..a82818b --- /dev/null +++ b/.changeset/app-token-client-id.md @@ -0,0 +1,4 @@ +--- +--- + +Use `client-id` instead of the deprecated `app-id` input in CD's app-token step diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml new file mode 100644 index 0000000..d6fc27a --- /dev/null +++ b/.github/actionlint.yaml @@ -0,0 +1,11 @@ +--- +# actionlint validates action inputs against a database of popular actions +# baked in at its release. That snapshot predates create-github-app-token +# v3.1.0, which added `client-id` and deprecated `app-id`, so it reads a +# correct `cd.yml` as both missing a required input and using an unknown one. +# Remove this file once an actionlint release refreshes that entry. +paths: + .github/workflows/cd.yml: + ignore: + - 'input "client-id" is not defined in action' + - 'missing input "app-id" which is required' diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml index 5d2c08f..4e595c7 100644 --- a/.github/workflows/cd.yml +++ b/.github/workflows/cd.yml @@ -53,7 +53,9 @@ jobs: - id: app-token uses: actions/create-github-app-token@v3 with: - app-id: ${{ vars.APP_ID }} + # Input rename only — `client-id` replaces the deprecated `app-id`, + # and the JWT `iss` claim it feeds accepts an App ID either way. + client-id: ${{ vars.APP_ID }} private-key: ${{ secrets.APP_PRIVATE_KEY }} # `gtb version` needs node_modules (the local changeset bin + gtb itself). diff --git a/AGENTS.md b/AGENTS.md index 19a4b31..eb69bb1 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -13,6 +13,7 @@ mise.lock — Per-platform binary checksums + download URLs mise.tasks.toml — Generated by `gtb sync mise`; hk:all / hk:base tasks (loaded via mise.toml's task_config.includes) mise.toml — Pin dev-tool versions for local + CI; postinstall hook installs hk .github/ + actionlint.yaml — Ignores for actionlint's stale popular-actions database actions/ mise-setup/ — Composite action: install + cache mise tools pnpm-resolve-pinned/ — Composite action: resolve locked version without install