Conversation
… workflows - Add `Check app secrets` step to all three dependabot workflow files so missing APP_ID/APP_PRIVATE_KEY secrets produce a clear, actionable error instead of the cryptic [@octokit/auth-app] appId option is required message - Add `skip-commit-verification: true` to dependabot/fetch-metadata in .github/workflows/dependabot-automerge.yml so it accepts the GitHub-authored merge commits produced by the dependabot-rebase workflow Closes #29 Co-authored-by: don-petry <don-petry@users.noreply.github.com>
|
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Check app secretsstep tostandards/workflows/dependabot-automerge.ymlandstandards/workflows/dependabot-rebase.ymlso a missingAPP_ID/APP_PRIVATE_KEYsecret produces a clear, actionable::error::annotation instead of the cryptic[@octokit/auth-app] appId option is requiredmessageAPP_IDvia environment variable (never logs the value) and exits 1 with a message pointing to the policy docRoot Cause
secrets.APP_IDresolved to an empty string in the workflow context (secret not configured at org level), causingactions/create-github-app-tokento fail with an opaque library error. A second issue is that.github/workflows/dependabot-automerge.ymlwas missingskip-commit-verification: true, which causesdependabot/fetch-metadatato reject the GitHub-authored merge commits produced by the rebase workflow.What Was Changed
standards/workflows/dependabot-automerge.yml— addCheck app secretsguard step beforeGenerate app tokenstandards/workflows/dependabot-rebase.yml— addCheck app secretsguard step beforeGenerate app tokenManual Follow-up Required
The GitHub App does not have
workflowspermission and cannot modify.github/workflows/files directly. After merging, a maintainer must manually sync.github/workflows/dependabot-automerge.yml(and the equivalent in ContentTwin) with the updatedstandards/workflows/dependabot-automerge.yml, specifically:skip-commit-verification: trueto thedependabot/fetch-metadatastepCheck app secretsstepAlso confirm that
APP_IDandAPP_PRIVATE_KEYsecrets are set at the org level (Settings → Secrets and variables → Actions).Closes #29
Generated with Claude Code