Fix the deprecated app-id input, and track failed AUR recoveries - #601
Conversation
create-github-app-token marks app-id deprecated in favour of client-id, and every run of the skills sync now emits the warning. The rename also fixes a real mismatch rather than just quieting a warning: RELEASE_CLIENT_ID holds an Iv23li-prefixed client ID, so the value was already a client ID being passed through the app-id input. GitHub accepts either as the JWT issuer, which is why it worked, but the input now says what the value is.
The release job notifies on AUR failure; the recovery workflow did not, so today's 0.8.0 recovery run failed and left nothing tracking it. The recovery path needs this more than the release job does. A recovery run is dispatched by hand and then forgotten, and its whole reason for existing is that the AUR was unreachable — which is exactly the outage still likely to be going when three retries run out, as it was here.
Sensitive Change Detection (shadow mode)This PR modifies control-plane files:
|
There was a problem hiding this comment.
Pull request overview
This PR makes two small fixes to the release/recovery GitHub Actions workflows, discovered while running the v0.8.0 AUR recovery path. First, it migrates the actions/create-github-app-token inputs from the deprecated app-id to client-id (which matches what RELEASE_CLIENT_ID actually holds — a client ID), silencing the deprecation warning emitted on every run. Second, it adds a failure-notification step to the standalone aur-publish.yml recovery workflow so that a failed recovery run (e.g., during the ongoing AUR push freeze) opens or comments on a tracking issue, matching the behavior already present in release.yml's aur-publish job.
Changes:
- Replace deprecated
app-idwithclient-idat all threecreate-github-app-tokencall sites (release.yml×2,sync-skills.yml×1). - Add an
issues: writepermission and aNotify on AUR publish failurestep toaur-publish.yml, reusing the open/comment-existing-issue pattern fromrelease.yml.
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
.github/workflows/release.yml |
Switches both create-github-app-token steps from app-id to client-id. |
.github/workflows/sync-skills.yml |
Switches the skills-token create-github-app-token step from app-id to client-id. |
.github/workflows/aur-publish.yml |
Adds issues: write and a if: failure() notification step that opens/comments an "AUR publish failure" issue with the run link and version. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
A bare failure() fired for every earlier step too. Five of the seven failure exits ahead of it are operator mistakes — a mistyped version, a version with no release, a refused downgrade, a refused pkgrel clobber, a missing AUR_KEY — and none of them fit the issue's advice to retry once the AUR accepts pushes again. Worse, the issue dedupes on title, so a typo would have landed a misleading comment on the genuine outage issue rather than opening anything of its own. Gate on the two failures that do mean the AUR is unreachable: the publish step exhausting its retries, and the RPC reachability check, which now records why it failed so the two cases can be told apart. Operator mistakes stay in the run the operator just dispatched by hand, which is where they are already visible.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d309b607f7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Two small fixes found by actually running the v0.8.0 recovery paths.
app-id→client-idcreate-github-app-tokenmarksapp-iddeprecated in favour ofclient-id, andevery skills-sync run now emits the warning twice.
This is not only warning cleanup.
RELEASE_CLIENT_IDholdsIv23li…— a client ID, which was being passed through theapp-idinput.GitHub accepts either as the JWT issuer, which is why it has worked, but the input
now says what the value actually is.
Three call sites:
release.yml×2 (Homebrew tap token, skills token) andsync-skills.yml×1.Notify when a recovery publish fails
release.yml'saur-publishjob opens an issue on failure. The standalonerecovery workflow did not — so today's 0.8.0 recovery run failed and left
nothing tracking it.
The recovery path needs this more than the release job does. A recovery run is
dispatched by hand and then forgotten, and its whole reason for existing is that
the AUR was unreachable — which is exactly the outage still likely to be going
when three retries run out.
That is precisely what happened here: the AUR has disabled pushes entirely since
2026-07-30
while Arch handles a wave of malicious package adoptions. Not a maintenance
window — retries cannot help, and 0.8.0 stays unpublished there until pushes are
re-enabled.
Verification
bin/ciexit 0,actionlintclean,zizmorreports no findings.Summary by cubic
Switch GitHub App auth to
client-idand add outage-only issue notifications for AUR recovery publishes. This removes warnings and files an issue only when the AUR is unreachable.client-idwithactions/create-github-app-tokeninrelease.yml(both tokens) andsync-skills.yml, matchingRELEASE_CLIENT_ID.aur-publish.yml, notify only when the AUR is unreachable (RPC check fails or retries are exhausted); include run link and version; dedupe by title and comment if open; addissues: write.Written for commit d309b60. Summary will update on new commits.