Skip to content

ci: replace GitHub App token with GITHUB_TOKEN in release workflows #23

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
guibeira merged 1 commit into from
Apr 9, 2026
+3 −52
Merged

ci: replace GitHub App token with GITHUB_TOKEN in release workflows #23

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 1 addition & 26 deletions .github/workflows/_rust-binary.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,11 +30,6 @@ on:
required: false
type: boolean
default: false
secrets:
GH_APP_ID:
required: true
GH_APP_PRIVATE_KEY:
required: true

env:
CARGO_TERM_COLOR: always
Expand All @@ -48,24 +43,13 @@ jobs:
permissions:
contents: write
steps:
- name: Generate token
if: inputs.skip_create_release != true && inputs.dry_run != true
id: generate_token
uses: actions/create-github-app-token@v2
with:
app-id: ${{ secrets.GH_APP_ID }}
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

- uses: actions/checkout@v4
if: inputs.skip_create_release != true && inputs.dry_run != true
with:
token: ${{ steps.generate_token.outputs.token }}

- name: Create GitHub Release
if: inputs.skip_create_release != true && inputs.dry_run != true
uses: softprops/action-gh-release@v2
with:
token: ${{ steps.generate_token.outputs.token }}
tag_name: ${{ inputs.tag_name }}
name: ${{ inputs.bin_name }} ${{ inputs.tag_name }}
draft: false
Expand Down Expand Up @@ -102,16 +86,7 @@ jobs:
os: ubuntu-22.04

steps:
- name: Generate token
id: generate_token
uses: actions/create-github-app-token@v2
with:
app-id: ${{ secrets.GH_APP_ID }}
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

- uses: actions/checkout@v4
with:
token: ${{ steps.generate_token.outputs.token }}

- name: Rewrite SSH to HTTPS for public deps
run: git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
Expand Down Expand Up @@ -154,5 +129,5 @@ jobs:
zip: windows
checksum: sha256
manifest-path: ${{ inputs.manifest_path }}
token: ${{ steps.generate_token.outputs.token }}
token: ${{ github.token }}
dry-run: ${{ inputs.dry_run }}
14 changes: 1 addition & 13 deletions .github/workflows/release-lsp-binary.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,21 +71,11 @@ jobs:
permissions:
contents: write
steps:
- name: Generate token
id: generate_token
uses: actions/create-github-app-token@v2
with:
app-id: ${{ secrets.GH_APP_ID }}
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

- uses: actions/checkout@v4
with:
token: ${{ steps.generate_token.outputs.token }}

- name: Create GitHub Release
uses: softprops/action-gh-release@v2
with:
token: ${{ steps.generate_token.outputs.token }}
tag_name: ${{ needs.setup.outputs.tag }}
name: iii-lsp ${{ needs.setup.outputs.version }}
draft: false
Expand All @@ -108,6 +98,4 @@ jobs:
is_prerelease: ${{ needs.setup.outputs.is_prerelease == 'true' }}
skip_create_release: true
dry_run: ${{ needs.setup.outputs.dry_run == 'true' }}
secrets:
GH_APP_ID: ${{ secrets.GH_APP_ID }}
GH_APP_PRIVATE_KEY: ${{ secrets.GH_APP_PRIVATE_KEY }}
secrets: inherit
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

wf=".github/workflows/_rust-binary.yml"

echo "== workflow_call header =="
sed -n '1,40p' "$wf"

echo
echo "== direct secret references in reusable workflow =="
rg -n -C2 '\bsecrets\.' "$wf" || true

echo
echo "== actions invoked by reusable workflow =="
rg -n '^\s*-?\s*uses:\s+' "$wf"

Repository: iii-hq/workers

Length of output: 1588

Remove unnecessary secret inheritance.

Line 101 forwards every available secret into the reusable workflow even though .github/workflows/_rust-binary.yml declares no workflow_call.secrets and contains no secrets. references. This unnecessarily broadens secret exposure to the called workflow and its third-party actions.

Suggested fix 
   binary-build:
     name: Binary Release
     needs: [setup, create-release]
     if: ${{ !failure() && !cancelled() }}
     uses: ./.github/workflows/_rust-binary.yml
     with:
       bin_name: iii-lsp
       manifest_path: iii-lsp/Cargo.toml
       tag_name: ${{ needs.setup.outputs.tag }}
       is_prerelease: ${{ needs.setup.outputs.is_prerelease == 'true' }}
       skip_create_release: true
       dry_run: ${{ needs.setup.outputs.dry_run == 'true' }}
-    secrets: inherit
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/release-lsp-binary.yml at line 101, Remove the unnecessary
"secrets: inherit" entry in the reusable workflow call in release-lsp-binary.yml
(the line that currently forwards all secrets) because the called reusable
workflow _rust-binary.yml declares no workflow_call.secrets and doesn't
reference secrets; delete that "secrets: inherit" line from the workflow call so
you don't forward every repository secret to the called workflow or its
third-party actions, and confirm that no workflow_call.secrets are expected by
the _rust-binary.yml workflow before committing.

14 changes: 1 addition & 13 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,21 +71,11 @@ jobs:
permissions:
contents: write
steps:
- name: Generate token
id: generate_token
uses: actions/create-github-app-token@v2
with:
app-id: ${{ secrets.GH_APP_ID }}
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

- uses: actions/checkout@v4
with:
token: ${{ steps.generate_token.outputs.token }}

- name: Create GitHub Release
uses: softprops/action-gh-release@v2
with:
token: ${{ steps.generate_token.outputs.token }}
tag_name: ${{ needs.setup.outputs.tag }}
name: image-resize ${{ needs.setup.outputs.version }}
draft: false
Expand All @@ -108,6 +98,4 @@ jobs:
is_prerelease: ${{ needs.setup.outputs.is_prerelease == 'true' }}
skip_create_release: true
dry_run: ${{ needs.setup.outputs.dry_run == 'true' }}
secrets:
GH_APP_ID: ${{ secrets.GH_APP_ID }}
GH_APP_PRIVATE_KEY: ${{ secrets.GH_APP_PRIVATE_KEY }}
secrets: inherit
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

wf=".github/workflows/_rust-binary.yml"

echo "== workflow_call header =="
sed -n '1,40p' "$wf"

echo
echo "== direct secret references in reusable workflow =="
rg -n -C2 '\bsecrets\.' "$wf" || true

echo
echo "== lines using github.token =="
rg -n -C1 '\bgithub\.token\b' "$wf"

Repository: iii-hq/workers

Length of output: 1453

Remove secrets: inherit — the reusable workflow does not declare or use secret inputs.

The .github/workflows/_rust-binary.yml workflow defines no secrets in its workflow_call interface and uses github.token for authentication (line 132). Passing secrets: inherit unnecessarily over-permissions the callee.

Suggested fix 
   binary-build:
     name: Binary Release
     needs: [setup, create-release]
     if: ${{ !failure() && !cancelled() }}
     uses: ./.github/workflows/_rust-binary.yml
     with:
       bin_name: image-resize
       manifest_path: image-resize/Cargo.toml
       tag_name: ${{ needs.setup.outputs.tag }}
       is_prerelease: ${{ needs.setup.outputs.is_prerelease == 'true' }}
       skip_create_release: true
       dry_run: ${{ needs.setup.outputs.dry_run == 'true' }}
-    secrets: inherit
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
secrets: inherit
binary-build:
name: Binary Release
needs: [setup, create-release]
if: ${{ !failure() && !cancelled() }}
uses: ./.github/workflows/_rust-binary.yml
with:
bin_name: image-resize
manifest_path: image-resize/Cargo.toml
tag_name: ${{ needs.setup.outputs.tag }}
is_prerelease: ${{ needs.setup.outputs.is_prerelease == 'true' }}
skip_create_release: true
dry_run: ${{ needs.setup.outputs.dry_run == 'true' }}
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/release.yml at line 101, Remove the unnecessary secrets
inheritance: locate the reusable workflow call that currently includes the key
"secrets: inherit" (the invocation of the _rust-binary reusable workflow) and
delete that "secrets: inherit" line so the caller no longer passes secrets to
the callee; leave the rest of the workflow_call invocation intact so the
reusable workflow continues to use github.token as before.

Loading