ci: use GitHub App token for node sync workflow#395
Conversation
Replaces the NODE_REPO_TOKEN PAT with a GitHub App installation token (NODE_SYNC_APP_CLIENT_ID / NODE_SYNC_APP_KEY) scoped to genlayerlabs/genlayer-node.
✅ Deploy Preview for genlayer-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Warning Rate limit exceeded
To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe pull request replaces manual token authentication with GitHub App-based token generation in CI/CD workflows. Documentation and workflow configuration are updated to use Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/README.md:
- Around line 76-77: Update the README to correctly describe
NODE_SYNC_APP_CLIENT_ID as the "GitHub App ID" (not "Client ID") and clarify
that NODE_SYNC_APP_KEY is the PEM private key for the GitHub App; alternatively,
if you prefer a clearer secret name, rename NODE_SYNC_APP_CLIENT_ID to something
like NODE_SYNC_APP_ID and update every place that references that secret (and
the actions/create-github-app-token input named app-id) so the secret name and
the workflow input remain consistent.
In @.github/workflows/sync-docs-from-node.yml:
- Around line 67-76: Replace the v1 action invocation and wrong credential
input: change uses: actions/create-github-app-token@v1 to uses:
actions/create-github-app-token@v3 and replace the app-id input that currently
uses ${{ secrets.NODE_SYNC_APP_CLIENT_ID }} with the client-id input (client-id:
${{ secrets.NODE_SYNC_APP_CLIENT_ID }}), keeping private-key: ${{
secrets.NODE_SYNC_APP_KEY }}; apply the same changes to the second occurrence of
actions/create-github-app-token in the workflow so both uses and inputs
(client-id vs app-id) match the secret type.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: ab401f40-aa98-42cf-a818-523d88d30ff5
📒 Files selected for processing (2)
.github/workflows/README.md.github/workflows/sync-docs-from-node.yml
| - `NODE_SYNC_APP_CLIENT_ID`: Client ID of the GitHub App | ||
| - `NODE_SYNC_APP_KEY`: PEM-encoded private key of the GitHub App |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify v1 input contract from upstream action metadata/docs.
curl -sL https://raw.githubusercontent.com/actions/create-github-app-token/v1/action.yml | sed -n '1,40p'
curl -sL https://raw.githubusercontent.com/actions/create-github-app-token/v1/README.md | rg -n "Inputs|app-id|client-id|GitHub App ID|Client ID"Repository: genlayerlabs/genlayer-docs
Length of output: 2427
🏁 Script executed:
#!/bin/bash
# Check the actual workflow file that uses these secrets
cd .github/workflows && ls -la | grep sync && cd - > /dev/null
cat .github/workflows/sync-docs-from-node.yml | grep -A 5 -B 5 "NODE_SYNC_APP_CLIENT_ID\|NODE_SYNC_APP_KEY\|app-id\|private-key"Repository: genlayerlabs/genlayer-docs
Length of output: 1018
🏁 Script executed:
#!/bin/bash
# Check the README.md current state for lines 76-77
cat -n .github/workflows/README.md | sed -n '70,85p'Repository: genlayerlabs/genlayer-docs
Length of output: 999
🌐 Web query:
GitHub App ID vs Client ID difference
💡 Result:
The GitHub App ID and Client ID are two distinct identifiers for GitHub Apps. App ID (numeric, integer): - Unique database/internal identifier for the GitHub App. - Primarily used to generate the JSON Web Token (JWT) with the private key to authenticate the app itself and fetch installation access tokens. - Found on the GitHub App's settings page. - Example: 12345 Client ID (alphanumeric string): - Used for OAuth flows: to sign in users, generate user access tokens, and request installations. - Now (since May 2024) can also be used interchangeably with App ID in the JWT 'iss' claim for minting JWTs to fetch installation tokens, simplifying usage. GitHub recommends transitioning to Client ID for future compatibility, though App ID is not deprecated. - Globally unique, unlike App ID. - Found on the GitHub App's settings page. - Not a secret; safe to expose to end users. - Example: Iv23f8doAlphaNumer1c Key differences: - Type: App ID is an integer; Client ID is a string. - Primary use: App ID traditionally for server-to-server (JWT/installation tokens); Client ID for user OAuth. - Both identify the app but serve different authentication flows. - Recent changes allow Client ID overlap with App ID usage to reduce confusion. Note: These are specific to GitHub Apps. OAuth Apps (separate type) only have a Client ID for their OAuth flow. To view both: Navigate to your GitHub App settings (Developer settings > GitHub Apps > Edit your app).
Citations:
- 1: https://github.blog/changelog/2024-05-01-github-apps-can-now-use-the-client-id-to-fetch-installation-tokens/
- 2: https://github.blog/changelog/2024-08-23-client-ids-are-now-included-in-app-api-responses
- 3: https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/authenticating-as-a-github-app-installation
- 4: https://github.blog/changelog/2024-05-01-github-apps-can-now-use-the-client-id-to-fetch-installation-tokens
Fix documentation: the input expects GitHub App ID, not Client ID.
The README says NODE_SYNC_APP_CLIENT_ID is a "Client ID," but the workflow passes this secret to the app-id input of actions/create-github-app-token@v1, which is documented as expecting a "GitHub App ID." While Client ID has been interchangeable with App ID for JWT-based installation token generation since May 2024, the documentation should match the input name to avoid maintainer confusion.
Update the README to clarify:
📝 Suggested fix
- `NODE_SYNC_APP_CLIENT_ID`: Client ID of the GitHub App
+ `NODE_SYNC_APP_CLIENT_ID`: GitHub App ID (numeric)Or rename the secret for clarity:
- `NODE_SYNC_APP_CLIENT_ID`: Client ID of the GitHub App
+ `NODE_SYNC_APP_ID`: GitHub App ID (numeric)(Requires updating the secret reference in .github/workflows/sync-docs-from-node.yml)
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - `NODE_SYNC_APP_CLIENT_ID`: Client ID of the GitHub App | |
| - `NODE_SYNC_APP_KEY`: PEM-encoded private key of the GitHub App | |
| - `NODE_SYNC_APP_CLIENT_ID`: GitHub App ID (numeric) | |
| - `NODE_SYNC_APP_KEY`: PEM-encoded private key of the GitHub App |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/README.md around lines 76 - 77, Update the README to
correctly describe NODE_SYNC_APP_CLIENT_ID as the "GitHub App ID" (not "Client
ID") and clarify that NODE_SYNC_APP_KEY is the PEM private key for the GitHub
App; alternatively, if you prefer a clearer secret name, rename
NODE_SYNC_APP_CLIENT_ID to something like NODE_SYNC_APP_ID and update every
place that references that secret (and the actions/create-github-app-token input
named app-id) so the secret name and the workflow input remain consistent.
Bumps actions/create-github-app-token to v3 and switches the credential input from app-id to client-id, matching the NODE_SYNC_APP_CLIENT_ID secret.
1 participant
Description
Replaces the
NODE_REPO_TOKENPAT with a GitHub App installation token for accessing the privategenlayerlabs/genlayer-noderepository in the docs sync workflow.Changes
.github/workflows/sync-docs-from-node.ymlpreparejob: addedactions/create-github-app-token@v1step (gated onversion == 'latest') and switched theDetect latest versionstep to use the App token.sync-filesjob: added the same token-mint step beforeClone source repositoryand switched the checkout to use the App token.owner: genlayerlabs/repositories: genlayer-node.secrets.NODE_REPO_TOKEN || secrets.GITHUB_TOKENfallbacks..github/workflows/README.md: replaced theNODE_REPO_TOKENPAT section with a GitHub App section documentingNODE_SYNC_APP_CLIENT_IDandNODE_SYNC_APP_KEY, plus the required App permission (Contents: Read) and installation target.Required Repo Secrets
NODE_SYNC_APP_CLIENT_ID— Client ID of the GitHub AppNODE_SYNC_APP_KEY— PEM-encoded private key of the GitHub AppThe App must be installed on
genlayerlabs/genlayer-nodewithContents: Read.Summary by CodeRabbit