Use GitHub App tokens in Claude workflows#2936
Conversation
|
Note Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
Greptile SummaryThis PR migrates all listed Claude automation workflows from PAT/default Key changes and observations:
Confidence Score: 4/5
Important Files Changed
Sequence DiagramsequenceDiagram
participant GH as GitHub Actions Runner
participant AppSvc as create-github-app-token
participant Base as Base Repo (dyad-sh/dyad)
participant Fork as Fork Repo (contributor)
participant Claude as claude-code-action
GH->>AppSvc: Request base-repo installation token<br/>(contents:write, pull-requests:write)
AppSvc-->>GH: base token
GH->>AppSvc: Request fork-scoped installation token<br/>(owner=fork owner, contents:write)
AppSvc-->>Fork: Authenticate via GitHub App
Fork-->>AppSvc: Grant token
AppSvc-->>GH: fork token
GH->>Base: Checkout repository (default GITHUB_TOKEN)
GH->>GH: Configure git push URL<br/>to use fork token
GH->>Claude: Run skill<br/>(github_token = base token)
Claude->>Base: PR labels, comments, API calls
Claude->>Fork: git push via configured push URL
Fork-->>GH: Triggers PR synchronize event
Note over Fork,GH: CI and downstream workflows fire normally
Last reviewed commit: 7668462 |
|
@BugBot run |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| - name: Create GitHub App token for PR head repo | ||
| if: steps.pr-info.outputs.should_continue == 'true' | ||
| id: head-app-token | ||
| uses: actions/create-github-app-token@v2 | ||
| with: | ||
| app-id: ${{ vars.DYAD_GITHUB_APP_ID }} | ||
| private-key: ${{ secrets.DYAD_GITHUB_APP_PRIVATE_KEY }} | ||
| owner: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.owner.login || github.event.workflow_run.head_repository.owner.login }} | ||
| repositories: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.name || github.event.workflow_run.head_repository.name }} |
There was a problem hiding this comment.
GitHub App must be installed on all allowed fork repositories
The Create GitHub App token for PR head repo step requests an installation token scoped to the contributor's fork repository (using the owner + repositories parameters). This step will fail with a 404 error if the GitHub App (DYAD_GITHUB_APP_ID) is not installed on the fork.
This is a critical operational prerequisite for all allowed PR authors (wwwillchen, wwwillchen-bot, dyadbot, princeaden1). If any of their forks lack the App installation, this step will fail and the entire workflow will abort — even though the earlier should_continue check was true.
The same concern applies to claude-rebase.yml at its equivalent step (lines 43–51). Consider either:
- Adding a fallback or graceful error handler for missing App installations, or
- Documenting that the GitHub App must be pre-installed on all contributor fork repos as a required setup step before this workflow can function.
Prompt To Fix With AI
This is a comment left during a code review.
Path: .github/workflows/pr-review-responder.yml
Line: 211-219
Comment:
**GitHub App must be installed on all allowed fork repositories**
The `Create GitHub App token for PR head repo` step requests an installation token scoped to the contributor's fork repository (using the `owner` + `repositories` parameters). This step will fail with a 404 error if the GitHub App (`DYAD_GITHUB_APP_ID`) is not installed on the fork.
This is a critical operational prerequisite for all allowed PR authors (`wwwillchen`, `wwwillchen-bot`, `dyadbot`, `princeaden1`). If any of their forks lack the App installation, this step will fail and the entire workflow will abort — even though the earlier `should_continue` check was `true`.
The same concern applies to `claude-rebase.yml` at its equivalent step (lines 43–51). Consider either:
1. Adding a fallback or graceful error handler for missing App installations, or
2. Documenting that the GitHub App must be pre-installed on all contributor fork repos as a required setup step before this workflow can function.
How can I resolve this? If you propose a fix, please make it concise.![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
🔍 Dyadbot Code Review SummaryVerdict: 🤔 NOT SURE - Potential issues Reviewed by 3 independent agents: Correctness Expert, Code Health Expert, UX Wizard. Issues Summary
🟡 MEDIUM: This workflow still references Suggestion: Add the same 🟢 Low Priority Notes (2 items)
🚫 Dropped False Positives (3 items)
Generated by Dyadbot multi-agent code review |
|
@BugBot run |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 766846250d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| private-key: ${{ secrets.DYAD_GITHUB_APP_PRIVATE_KEY }} | ||
| owner: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.owner.login || github.event.workflow_run.head_repository.owner.login }} | ||
| repositories: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.name || github.event.workflow_run.head_repository.name }} | ||
| permission-contents: write |
There was a problem hiding this comment.
This token is used for the git push path, but it only requests permission-contents: write; GitHub rejects pushes that modify .github/workflows/* unless the credential also has workflow-write permission. In PRs where /dyad:pr-fix updates workflow files, the push step will fail and the automation loop cannot complete, so this token should also request permission-workflows: write (the same risk applies to the analogous head-token setup in claude-rebase.yml).
Useful? React with 👍 / 👎.
🔍 Dyadbot Code Review SummaryVerdict: ✅ YES - Ready to merge Reviewed by 3 independent agents: Correctness Expert, Code Health Expert, UX Wizard. ✅ No new issues found by multi-agent review. The token migration is clean and consistent across all 8 workflow files. The dual-token pattern (base-repo + fork-scoped) in 🚫 Dropped False Positives (5 items)
Generated by Dyadbot multi-agent code review |
github-actions
bot
added
the
needs-human:review-issue
🎭 Playwright Test Results❌ Some tests failed
Summary: 249 passed, 1 failed, 9 flaky, 6 skipped Failed Tests🍎 macOS
📋 Re-run Failing Tests (macOS)Copy and paste to re-run all failing spec files locally: npm run e2e \
e2e-tests/annotator.spec.ts
|
1 participant
Summary
Test plan
🤖 Generated with Claude Code