feat: support GitHub App tokens for branded PR comments by lbliii · Pull Request #83 · lbliii/kida

lbliii · 2026-04-12T15:17:04Z

Summary

Adds app-id and app-private-key inputs to the Kida action so PR comments can be posted under a custom GitHub App identity instead of the generic "github-actions" bot
Uses actions/create-github-app-token@v1 to generate short-lived tokens; falls back to the existing token input when app-id is not provided
Updates tests.yml to pass the new app secrets to all four report steps

Test plan

Install the "Kida Templates" GitHub App on the account
Verify PR comments on this PR show the app's name and avatar
Verify CI still works on push events (no app token needed, falls back to default)

🤖 Generated with Claude Code

Add app-id and app-private-key inputs to the action so PR comments can be posted under a custom GitHub App identity instead of the generic github-actions bot. Uses actions/create-github-app-token to generate short-lived tokens. Falls back to the existing token input when app-id is not provided. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Copilot

Pull request overview

Adds support for posting PR comments using a GitHub App identity by generating a short-lived installation token, while preserving the existing token input fallback behavior.

Changes:

Introduces app-id and app-private-key inputs to enable GitHub App–based authentication.
Generates an installation token via actions/create-github-app-token@v1 and uses it for gh-based PR comment posting.
Updates CI workflow steps to pass the new app credentials into the action invocations.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.

File	Description
`action.yml`	Adds new inputs and a token-generation step; switches PR comment posting to use the app token when configured.
`.github/workflows/tests.yml`	Passes GitHub App credentials to each report-rendering step in CI.

Copilot · 2026-04-12T15:19:52Z

+    description: 'GitHub token for posting PR comments. Only needed when post-to includes pr-comment. Ignored when app-id is provided.'
    required: false
    default: ${{ github.token }}
+  app-id:
+    description: >
+      GitHub App ID for posting PR comments with a branded identity.
+      When provided (along with app-private-key), a short-lived token is
+      generated automatically and used instead of the token input.


The token input description says it is “Ignored when app-id is provided”, but inputs.token is still used for GitHub API calls in the “Collect GitHub PR data” step (e.g., when data-format: github-prs). Either narrow the description to clarify it’s only ignored for PR comment posting, or generate/reuse the app token earlier and use it for the collection step as well.

Suggested change

description: 'GitHub token for posting PR comments. Only needed when post-to includes pr-comment. Ignored when app-id is provided.'

required: false

default: ${{ github.token }}

app-id:

description: >

GitHub App ID for posting PR comments with a branded identity.

When provided (along with app-private-key), a short-lived token is

generated automatically and used instead of the token input.

description: >

GitHub token for GitHub API operations such as collecting PR data and

posting PR comments. Required when those operations are used. When

app-id is provided, a short-lived app token is generated and used for

PR comment posting instead of this token input.

required: false

default: ${{ github.token }}

app-id:

description: >

GitHub App ID for posting PR comments with a branded identity.

When provided (along with app-private-key), a short-lived token is

generated automatically and used for PR comment posting.

Copilot · 2026-04-12T15:19:53Z

+    - name: Generate app token
+      id: app-token
+      if: inputs.app-id != ''
+      uses: actions/create-github-app-token@v1
+      with:
+        app-id: ${{ inputs.app-id }}
+        private-key: ${{ inputs.app-private-key }}


Generate app token runs whenever app-id is set, even if post-to doesn’t include pr-comment. That can make step-summary-only runs fail (e.g., misconfigured app secrets / app not installed) despite not needing an app token. Consider gating this step on contains(inputs.post-to, 'pr-comment') (and similarly only using the app token when posting PR comments).

Copilot · 2026-04-12T15:19:53Z

+    - name: Generate app token
+      id: app-token
+      if: inputs.app-id != ''
+      uses: actions/create-github-app-token@v1
+      with:
+        app-id: ${{ inputs.app-id }}
+        private-key: ${{ inputs.app-private-key }}
+
    - name: Post report
      id: post
      shell: bash
      env:
-        GH_TOKEN: ${{ inputs.token }}
+        GH_TOKEN: ${{ inputs.app-id != '' && steps.app-token.outputs.token || inputs.token }}
      run: |


app-private-key is documented as required when app-id is set, but this isn’t enforced. With the current GH_TOKEN expression, a missing/empty app-private-key can silently fall back to inputs.token, masking configuration errors. Add an explicit validation that fails when inputs.app-id is non-empty and inputs.app-private-key is empty (and/or avoid fallback when app-id is provided).

Copilot · 2026-04-12T15:19:53Z

          template: pytest
          data: reports/pytest.xml
          data-format: junit-xml
          post-to: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && 'step-summary,pr-comment' || 'step-summary' }}
          comment-header: CI Report
+          app-id: ${{ secrets.KIDA_APP_ID }}
+          app-private-key: ${{ secrets.KIDA_APP_PRIVATE_KEY }}
          python-version: skip


These app credentials are passed unconditionally. On non-PR runs (push/schedule) this causes the action to attempt GitHub App token generation (given the current action.yml logic), which can fail even when post-to resolves to step-summary only, and also conflicts with the test plan’s stated “push falls back to default”. Consider only passing app-id / app-private-key when post-to includes pr-comment (e.g., via an expression conditioned on the PR event and same-repo check).

Copilot · 2026-04-12T15:19:53Z

          data: reports/coverage.json
          post-to: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && 'step-summary,pr-comment' || 'step-summary' }}
          comment-header: CI Report
          comment-mode: append
          context: "${{ steps.changed.outputs.files && format('{0}{1}{2}', '{\"changed_files\": ', steps.changed.outputs.files, '}') || '' }}"
+          app-id: ${{ secrets.KIDA_APP_ID }}
+          app-private-key: ${{ secrets.KIDA_APP_PRIVATE_KEY }}
          python-version: skip


These app credentials are passed unconditionally. On non-PR runs (push/schedule) this can trigger GitHub App token generation even when not posting PR comments, and may fail if app secrets/config are unavailable. Consider only passing app-id / app-private-key when post-to includes pr-comment.

Copilot · 2026-04-12T15:19:53Z

          data: reports/ty.xml
          data-format: junit-xml
          post-to: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && 'step-summary,pr-comment' || 'step-summary' }}
          comment-header: CI Report
          comment-mode: append
+          app-id: ${{ secrets.KIDA_APP_ID }}
+          app-private-key: ${{ secrets.KIDA_APP_PRIVATE_KEY }}
          python-version: skip


These app credentials are passed unconditionally. On non-PR runs (push/schedule) this can trigger GitHub App token generation even when not posting PR comments, and may fail if app secrets/config are unavailable. Consider only passing app-id / app-private-key when post-to includes pr-comment.

Copilot · 2026-04-12T15:19:54Z

          template: ruff
          data: reports/ruff.json
          post-to: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && 'step-summary,pr-comment' || 'step-summary' }}
          comment-header: CI Report
          comment-mode: append
+          app-id: ${{ secrets.KIDA_APP_ID }}
+          app-private-key: ${{ secrets.KIDA_APP_PRIVATE_KEY }}
          python-version: skip


These app credentials are passed unconditionally. On non-PR runs (push/schedule) this can trigger GitHub App token generation even when not posting PR comments, and may fail if app secrets/config are unavailable. Consider only passing app-id / app-private-key when post-to includes pr-comment.

Copilot AI review requested due to automatic review settings April 12, 2026 15:17

Copilot started reviewing on behalf of lbliii April 12, 2026 15:17 View session

Copilot AI reviewed Apr 12, 2026

View reviewed changes

lbliii merged commit a57a0d6 into main Apr 12, 2026
14 checks passed

lbliii deleted the lbliii/kida-gh-action-chat branch April 12, 2026 15:25

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: support GitHub App tokens for branded PR comments#83

feat: support GitHub App tokens for branded PR comments#83
lbliii merged 1 commit intomainfrom
lbliii/kida-gh-action-chat

lbliii commented Apr 12, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 12, 2026

Uh oh!

Copilot AI Apr 12, 2026

Uh oh!

Copilot AI Apr 12, 2026

Uh oh!

Copilot AI Apr 12, 2026

Uh oh!

Copilot AI Apr 12, 2026

Uh oh!

Copilot AI Apr 12, 2026

Uh oh!

Copilot AI Apr 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

lbliii commented Apr 12, 2026

Summary

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants