ci: authenticate the protocol sync as a GitHub App - #388
Merged
Conversation
SDK_SYNC_TOKEN was never set, which is why this workflow spent its whole life skipping silently. Replacing it with a PAT would have re-created the same failure mode on a timer: a PAT belongs to a person and expires, and the ghcr pull secret already took the fleet down once by lapsing at 30 days. The asobi-protocol-sync App is owned by the org and mints a token per run that dies with the job. Each matrix leg mints one scoped to just the repo it syncs, so a leg cannot write to the other six. The header comment also said "contents:write and pull-requests:write", which are API scope names and appear nowhere in the UI that creates these credentials - it now names what the App form actually shows.
🟡 Code Coverage — 75.3%6684 of 8876 lines covered. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-on from #387, which made this workflow fail rather than skip. This gives it credentials that work.
Why an App rather than a PAT
SDK_SYNC_TOKENwas never set — that is why the workflow spent its whole life reporting success while syncing nothing. Replacing it with a PAT would have re-created the same failure mode on a timer: a PAT belongs to a person and expires, and the ghcr pull secret already took the fleet down once by lapsing at 30 days.asobi-protocol-syncis owned by the org and mints a token per run that dies with the job. Nothing to rotate, nothing tied to one person's account.Scoping
Each matrix leg mints a token scoped to only the repo that leg syncs (
repositories: asobi-${{ matrix.sdk }}), so the unity leg cannot write to the other six. Verified that expression resolves to a real repo for all seven SDKs.Also
The header said the credential needed "contents:write and pull-requests:write". Those are API scope names and appear nowhere in the UI that actually creates these — the form shows Contents and Pull requests dropdowns set to Read and write. The comment now says what you will actually see, so the next person setting this up does not go looking for a checkbox that does not exist.
Setup, already done
SDK_SYNC_APP_IDvariable andSDK_SYNC_APP_PRIVATE_KEYsecret are set on this repoasobi-*SDK reposThe credential check still fails loudly if either goes missing — including the case where the App gets uninstalled from one SDK repo, or a new SDK joins the matrix and nobody installs it there.