From e021cb7e5320defc70d4fdfa6f99668b2af139ae Mon Sep 17 00:00:00 2001 From: Peli de Halleux Date: Tue, 3 Feb 2026 00:39:04 +0000 Subject: [PATCH] disable apps usage --- .github/workflows/artifacts-summary.lock.yml | 62 ++--------------- .github/workflows/changeset.lock.yml | 67 +++---------------- .github/workflows/daily-file-diet.lock.yml | 62 ++--------------- .../daily-testify-uber-super-expert.lock.yml | 62 ++--------------- .github/workflows/shared/github-mcp-app.md | 10 +-- .github/workflows/shared/safe-output-app.md | 8 +-- .github/workflows/smoke-claude.lock.yml | 33 +-------- 7 files changed, 38 insertions(+), 266 deletions(-) diff --git a/.github/workflows/artifacts-summary.lock.yml b/.github/workflows/artifacts-summary.lock.yml index 38d5eb4677..7eccc5c244 100644 --- a/.github/workflows/artifacts-summary.lock.yml +++ b/.github/workflows/artifacts-summary.lock.yml @@ -26,7 +26,7 @@ # - shared/reporting.md # - shared/safe-output-app.md # -# frontmatter-hash: e5cf92b29e9b951356ec917649105bbedeb80165f805e7b026bc2f0728500b62 +# frontmatter-hash: 0b0e8ff9ce885125b359364aa3d61b6cb25e5b7a0337dee5f1d16e501b8c72d1 name: "Artifacts Summary" "on": @@ -846,19 +846,6 @@ jobs: uses: ./actions/setup with: destination: /opt/gh-aw/actions - - name: Generate GitHub App token - id: safe-outputs-app-token - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1 - with: - app-id: ${{ vars.APP_ID }} - private-key: ${{ secrets.APP_PRIVATE_KEY }} - owner: ${{ github.repository_owner }} - repositories: ${{ github.event.repository.name }} - github-api-url: ${{ github.api_url }} - permission-contents: read - permission-discussions: write - permission-issues: write - permission-pull-requests: write - name: Debug job inputs env: COMMENT_ID: ${{ needs.activation.outputs.comment_id }} @@ -889,7 +876,7 @@ jobs: GH_AW_NOOP_MAX: 1 GH_AW_WORKFLOW_NAME: "Artifacts Summary" with: - github-token: ${{ steps.safe-outputs-app-token.outputs.token }} + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); setupGlobals(core, github, context, exec, io); @@ -902,7 +889,7 @@ jobs: GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }} GH_AW_WORKFLOW_NAME: "Artifacts Summary" with: - github-token: ${{ steps.safe-outputs-app-token.outputs.token }} + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); setupGlobals(core, github, context, exec, io); @@ -918,7 +905,7 @@ jobs: GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }} GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.agent.outputs.secret_verification_result }} with: - github-token: ${{ steps.safe-outputs-app-token.outputs.token }} + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); setupGlobals(core, github, context, exec, io); @@ -936,25 +923,12 @@ jobs: GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }} GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.result }} with: - github-token: ${{ steps.safe-outputs-app-token.outputs.token }} + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); setupGlobals(core, github, context, exec, io); const { main } = require('/opt/gh-aw/actions/notify_comment_error.cjs'); await main(); - - name: Invalidate GitHub App token - if: always() && steps.safe-outputs-app-token.outputs.token != '' - env: - TOKEN: ${{ steps.safe-outputs-app-token.outputs.token }} - run: | - echo "Revoking GitHub App installation token..." - # GitHub CLI will auth with the token being revoked. - gh api \ - --method DELETE \ - -H "Authorization: token $TOKEN" \ - /installation/token || echo "Token revoke may already be expired." - - echo "Token invalidation step complete." detection: needs: agent @@ -1102,17 +1076,6 @@ jobs: mkdir -p /tmp/gh-aw/safeoutputs/ find "/tmp/gh-aw/safeoutputs/" -type f -print echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV" - - name: Generate GitHub App token - id: safe-outputs-app-token - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1 - with: - app-id: ${{ vars.APP_ID }} - private-key: ${{ secrets.APP_PRIVATE_KEY }} - owner: ${{ github.repository_owner }} - repositories: ${{ github.event.repository.name }} - github-api-url: ${{ github.api_url }} - permission-contents: read - permission-discussions: write - name: Process Safe Outputs id: process_safe_outputs uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 @@ -1120,23 +1083,10 @@ jobs: GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }} GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_discussion\":{\"category\":\"artifacts\",\"close_older_discussions\":true,\"expires\":168,\"max\":1},\"missing_data\":{},\"missing_tool\":{}}" with: - github-token: ${{ steps.safe-outputs-app-token.outputs.token }} + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); setupGlobals(core, github, context, exec, io); const { main } = require('/opt/gh-aw/actions/safe_output_handler_manager.cjs'); await main(); - - name: Invalidate GitHub App token - if: always() && steps.safe-outputs-app-token.outputs.token != '' - env: - TOKEN: ${{ steps.safe-outputs-app-token.outputs.token }} - run: | - echo "Revoking GitHub App installation token..." - # GitHub CLI will auth with the token being revoked. - gh api \ - --method DELETE \ - -H "Authorization: token $TOKEN" \ - /installation/token || echo "Token revoke may already be expired." - - echo "Token invalidation step complete." diff --git a/.github/workflows/changeset.lock.yml b/.github/workflows/changeset.lock.yml index f77f119b1f..ac0b334cc7 100644 --- a/.github/workflows/changeset.lock.yml +++ b/.github/workflows/changeset.lock.yml @@ -27,7 +27,7 @@ # - shared/jqschema.md # - shared/safe-output-app.md # -# frontmatter-hash: 1a5e880443681dd251dcfbd197e9593e0371154720abc8529382a0e000442434 +# frontmatter-hash: 7e6053030f70916a77adbbfb53db29f50d92e131241225fdaf96cc0085f812ad name: "Changeset Generator" "on": @@ -1013,19 +1013,6 @@ jobs: uses: ./actions/setup with: destination: /opt/gh-aw/actions - - name: Generate GitHub App token - id: safe-outputs-app-token - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1 - with: - app-id: ${{ vars.APP_ID }} - private-key: ${{ secrets.APP_PRIVATE_KEY }} - owner: ${{ github.repository_owner }} - repositories: ${{ github.event.repository.name }} - github-api-url: ${{ github.api_url }} - permission-contents: read - permission-discussions: write - permission-issues: write - permission-pull-requests: write - name: Debug job inputs env: COMMENT_ID: ${{ needs.activation.outputs.comment_id }} @@ -1056,7 +1043,7 @@ jobs: GH_AW_NOOP_MAX: 1 GH_AW_WORKFLOW_NAME: "Changeset Generator" with: - github-token: ${{ steps.safe-outputs-app-token.outputs.token }} + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); setupGlobals(core, github, context, exec, io); @@ -1069,7 +1056,7 @@ jobs: GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }} GH_AW_WORKFLOW_NAME: "Changeset Generator" with: - github-token: ${{ steps.safe-outputs-app-token.outputs.token }} + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); setupGlobals(core, github, context, exec, io); @@ -1085,7 +1072,7 @@ jobs: GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }} GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.agent.outputs.secret_verification_result }} with: - github-token: ${{ steps.safe-outputs-app-token.outputs.token }} + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); setupGlobals(core, github, context, exec, io); @@ -1103,25 +1090,12 @@ jobs: GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }} GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.result }} with: - github-token: ${{ steps.safe-outputs-app-token.outputs.token }} + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); setupGlobals(core, github, context, exec, io); const { main } = require('/opt/gh-aw/actions/notify_comment_error.cjs'); await main(); - - name: Invalidate GitHub App token - if: always() && steps.safe-outputs-app-token.outputs.token != '' - env: - TOKEN: ${{ steps.safe-outputs-app-token.outputs.token }} - run: | - echo "Revoking GitHub App installation token..." - # GitHub CLI will auth with the token being revoked. - gh api \ - --method DELETE \ - -H "Authorization: token $TOKEN" \ - /installation/token || echo "Token revoke may already be expired." - - echo "Token invalidation step complete." detection: needs: agent @@ -1291,23 +1265,11 @@ jobs: with: name: agent-artifacts path: /tmp/gh-aw/ - - name: Generate GitHub App token - id: safe-outputs-app-token - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1 - with: - app-id: ${{ vars.APP_ID }} - private-key: ${{ secrets.APP_PRIVATE_KEY }} - owner: ${{ github.repository_owner }} - repositories: ${{ github.event.repository.name }} - github-api-url: ${{ github.api_url }} - permission-contents: write - permission-issues: write - permission-pull-requests: write - name: Checkout repository if: ((!cancelled()) && (needs.agent.result != 'skipped')) && (contains(needs.agent.outputs.output_types, 'push_to_pull_request_branch')) uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6 with: - token: ${{ steps.safe-outputs-app-token.outputs.token }} + token: ${{ github.token }} persist-credentials: false fetch-depth: 1 - name: Configure Git credentials @@ -1315,7 +1277,7 @@ jobs: env: REPO_NAME: ${{ github.repository }} SERVER_URL: ${{ github.server_url }} - GIT_TOKEN: ${{ steps.safe-outputs-app-token.outputs.token }} + GIT_TOKEN: ${{ github.token }} run: | git config --global user.email "github-actions[bot]@users.noreply.github.com" git config --global user.name "github-actions[bot]" @@ -1330,23 +1292,10 @@ jobs: GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }} GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"missing_data\":{},\"missing_tool\":{},\"push_to_pull_request_branch\":{\"base_branch\":\"${{ github.ref_name }}\",\"commit_title_suffix\":\" [skip-ci]\",\"if_no_changes\":\"warn\",\"max_patch_size\":1024},\"update_pull_request\":{\"allow_body\":true,\"allow_title\":false,\"default_operation\":\"append\",\"max\":1}}" with: - github-token: ${{ steps.safe-outputs-app-token.outputs.token }} + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); setupGlobals(core, github, context, exec, io); const { main } = require('/opt/gh-aw/actions/safe_output_handler_manager.cjs'); await main(); - - name: Invalidate GitHub App token - if: always() && steps.safe-outputs-app-token.outputs.token != '' - env: - TOKEN: ${{ steps.safe-outputs-app-token.outputs.token }} - run: | - echo "Revoking GitHub App installation token..." - # GitHub CLI will auth with the token being revoked. - gh api \ - --method DELETE \ - -H "Authorization: token $TOKEN" \ - /installation/token || echo "Token revoke may already be expired." - - echo "Token invalidation step complete." diff --git a/.github/workflows/daily-file-diet.lock.yml b/.github/workflows/daily-file-diet.lock.yml index 7066a56b45..73898bacce 100644 --- a/.github/workflows/daily-file-diet.lock.yml +++ b/.github/workflows/daily-file-diet.lock.yml @@ -26,7 +26,7 @@ # - shared/reporting.md # - shared/safe-output-app.md # -# frontmatter-hash: 841a772a9f69db6628d959d7ff54a9a93a51360dc78ed300d2d2ec37750c0b65 +# frontmatter-hash: c0409c152ec3e87335fed24573951a6c5fea4a8aa0fc40821b7022059b4e48ec name: "Daily File Diet" "on": @@ -884,19 +884,6 @@ jobs: uses: ./actions/setup with: destination: /opt/gh-aw/actions - - name: Generate GitHub App token - id: safe-outputs-app-token - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1 - with: - app-id: ${{ vars.APP_ID }} - private-key: ${{ secrets.APP_PRIVATE_KEY }} - owner: ${{ github.repository_owner }} - repositories: ${{ github.event.repository.name }} - github-api-url: ${{ github.api_url }} - permission-contents: read - permission-discussions: write - permission-issues: write - permission-pull-requests: write - name: Debug job inputs env: COMMENT_ID: ${{ needs.activation.outputs.comment_id }} @@ -928,7 +915,7 @@ jobs: GH_AW_WORKFLOW_NAME: "Daily File Diet" GH_AW_TRACKER_ID: "daily-file-diet" with: - github-token: ${{ steps.safe-outputs-app-token.outputs.token }} + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); setupGlobals(core, github, context, exec, io); @@ -942,7 +929,7 @@ jobs: GH_AW_WORKFLOW_NAME: "Daily File Diet" GH_AW_TRACKER_ID: "daily-file-diet" with: - github-token: ${{ steps.safe-outputs-app-token.outputs.token }} + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); setupGlobals(core, github, context, exec, io); @@ -959,7 +946,7 @@ jobs: GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }} GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.agent.outputs.secret_verification_result }} with: - github-token: ${{ steps.safe-outputs-app-token.outputs.token }} + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); setupGlobals(core, github, context, exec, io); @@ -978,25 +965,12 @@ jobs: GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }} GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.result }} with: - github-token: ${{ steps.safe-outputs-app-token.outputs.token }} + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); setupGlobals(core, github, context, exec, io); const { main } = require('/opt/gh-aw/actions/notify_comment_error.cjs'); await main(); - - name: Invalidate GitHub App token - if: always() && steps.safe-outputs-app-token.outputs.token != '' - env: - TOKEN: ${{ steps.safe-outputs-app-token.outputs.token }} - run: | - echo "Revoking GitHub App installation token..." - # GitHub CLI will auth with the token being revoked. - gh api \ - --method DELETE \ - -H "Authorization: token $TOKEN" \ - /installation/token || echo "Token revoke may already be expired." - - echo "Token invalidation step complete." detection: needs: agent @@ -1188,17 +1162,6 @@ jobs: mkdir -p /tmp/gh-aw/safeoutputs/ find "/tmp/gh-aw/safeoutputs/" -type f -print echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV" - - name: Generate GitHub App token - id: safe-outputs-app-token - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1 - with: - app-id: ${{ vars.APP_ID }} - private-key: ${{ secrets.APP_PRIVATE_KEY }} - owner: ${{ github.repository_owner }} - repositories: ${{ github.event.repository.name }} - github-api-url: ${{ github.api_url }} - permission-contents: read - permission-issues: write - name: Process Safe Outputs id: process_safe_outputs uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 @@ -1206,23 +1169,10 @@ jobs: GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }} GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"expires\":48,\"labels\":[\"refactoring\",\"code-health\",\"automated-analysis\",\"cookie\"],\"max\":1,\"title_prefix\":\"[file-diet] \"},\"missing_data\":{},\"missing_tool\":{}}" with: - github-token: ${{ steps.safe-outputs-app-token.outputs.token }} + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); setupGlobals(core, github, context, exec, io); const { main } = require('/opt/gh-aw/actions/safe_output_handler_manager.cjs'); await main(); - - name: Invalidate GitHub App token - if: always() && steps.safe-outputs-app-token.outputs.token != '' - env: - TOKEN: ${{ steps.safe-outputs-app-token.outputs.token }} - run: | - echo "Revoking GitHub App installation token..." - # GitHub CLI will auth with the token being revoked. - gh api \ - --method DELETE \ - -H "Authorization: token $TOKEN" \ - /installation/token || echo "Token revoke may already be expired." - - echo "Token invalidation step complete." diff --git a/.github/workflows/daily-testify-uber-super-expert.lock.yml b/.github/workflows/daily-testify-uber-super-expert.lock.yml index 28854b88d2..2b38e3c9c0 100644 --- a/.github/workflows/daily-testify-uber-super-expert.lock.yml +++ b/.github/workflows/daily-testify-uber-super-expert.lock.yml @@ -26,7 +26,7 @@ # - shared/reporting.md # - shared/safe-output-app.md # -# frontmatter-hash: 8f05b8c43e0f3e71cfe8f62a4545585b01274a32b9c2668cd9c638f3bc40d9f4 +# frontmatter-hash: 7d8e53e9fb651ca8ed59f03635300d5be979b8a42ffc4a3a78bce5e8d641bb6d name: "Daily Testify Uber Super Expert" "on": @@ -928,19 +928,6 @@ jobs: uses: ./actions/setup with: destination: /opt/gh-aw/actions - - name: Generate GitHub App token - id: safe-outputs-app-token - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1 - with: - app-id: ${{ vars.APP_ID }} - private-key: ${{ secrets.APP_PRIVATE_KEY }} - owner: ${{ github.repository_owner }} - repositories: ${{ github.event.repository.name }} - github-api-url: ${{ github.api_url }} - permission-contents: read - permission-discussions: write - permission-issues: write - permission-pull-requests: write - name: Debug job inputs env: COMMENT_ID: ${{ needs.activation.outputs.comment_id }} @@ -972,7 +959,7 @@ jobs: GH_AW_WORKFLOW_NAME: "Daily Testify Uber Super Expert" GH_AW_TRACKER_ID: "daily-testify-uber-super-expert" with: - github-token: ${{ steps.safe-outputs-app-token.outputs.token }} + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); setupGlobals(core, github, context, exec, io); @@ -986,7 +973,7 @@ jobs: GH_AW_WORKFLOW_NAME: "Daily Testify Uber Super Expert" GH_AW_TRACKER_ID: "daily-testify-uber-super-expert" with: - github-token: ${{ steps.safe-outputs-app-token.outputs.token }} + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); setupGlobals(core, github, context, exec, io); @@ -1003,7 +990,7 @@ jobs: GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }} GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.agent.outputs.secret_verification_result }} with: - github-token: ${{ steps.safe-outputs-app-token.outputs.token }} + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); setupGlobals(core, github, context, exec, io); @@ -1022,25 +1009,12 @@ jobs: GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }} GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.result }} with: - github-token: ${{ steps.safe-outputs-app-token.outputs.token }} + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); setupGlobals(core, github, context, exec, io); const { main } = require('/opt/gh-aw/actions/notify_comment_error.cjs'); await main(); - - name: Invalidate GitHub App token - if: always() && steps.safe-outputs-app-token.outputs.token != '' - env: - TOKEN: ${{ steps.safe-outputs-app-token.outputs.token }} - run: | - echo "Revoking GitHub App installation token..." - # GitHub CLI will auth with the token being revoked. - gh api \ - --method DELETE \ - -H "Authorization: token $TOKEN" \ - /installation/token || echo "Token revoke may already be expired." - - echo "Token invalidation step complete." detection: needs: agent @@ -1293,17 +1267,6 @@ jobs: mkdir -p /tmp/gh-aw/safeoutputs/ find "/tmp/gh-aw/safeoutputs/" -type f -print echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV" - - name: Generate GitHub App token - id: safe-outputs-app-token - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1 - with: - app-id: ${{ vars.APP_ID }} - private-key: ${{ secrets.APP_PRIVATE_KEY }} - owner: ${{ github.repository_owner }} - repositories: ${{ github.event.repository.name }} - github-api-url: ${{ github.api_url }} - permission-contents: read - permission-issues: write - name: Process Safe Outputs id: process_safe_outputs uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 @@ -1311,23 +1274,10 @@ jobs: GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }} GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"expires\":48,\"labels\":[\"testing\",\"code-quality\",\"automated-analysis\",\"cookie\"],\"max\":1,\"title_prefix\":\"[testify-expert] \"},\"missing_data\":{},\"missing_tool\":{}}" with: - github-token: ${{ steps.safe-outputs-app-token.outputs.token }} + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs'); setupGlobals(core, github, context, exec, io); const { main } = require('/opt/gh-aw/actions/safe_output_handler_manager.cjs'); await main(); - - name: Invalidate GitHub App token - if: always() && steps.safe-outputs-app-token.outputs.token != '' - env: - TOKEN: ${{ steps.safe-outputs-app-token.outputs.token }} - run: | - echo "Revoking GitHub App installation token..." - # GitHub CLI will auth with the token being revoked. - gh api \ - --method DELETE \ - -H "Authorization: token $TOKEN" \ - /installation/token || echo "Token revoke may already be expired." - - echo "Token invalidation step complete." diff --git a/.github/workflows/shared/github-mcp-app.md b/.github/workflows/shared/github-mcp-app.md index 40647e2a4d..a27b5fee36 100644 --- a/.github/workflows/shared/github-mcp-app.md +++ b/.github/workflows/shared/github-mcp-app.md @@ -1,9 +1,9 @@ --- -tools: - github: - app: - app-id: ${{ vars.APP_ID }} - private-key: ${{ secrets.APP_PRIVATE_KEY }} +#tools: +# github: +# app: +# app-id: ${{ vars.APP_ID }} +# private-key: ${{ secrets.APP_PRIVATE_KEY }} ---