mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-24 16:54:43 +00:00
1f76bdc5b2
Composite actions cannot access the secrets context — the runner's template engine rejects secrets.* references at load time with 'Unrecognized named-value: secrets'. Move APP_ID and APP_PRIVATE_KEY from direct secrets.* references inside the composite action to inputs passed by each calling workflow. The fallback logic (GITHUB_TOKEN when APP_ID is empty, for fork PRs) stays in the composite action's check step.
59 lines
2.1 KiB
YAML
59 lines
2.1 KiB
YAML
name: Get GitHub App Token
|
|
description: >-
|
|
Mint a short-lived (1-hour) installation access token from the repo's
|
|
GitHub App, replacing the long-lived AUTOFIX_BOT_PAT. App tokens get
|
|
5,000 req/hr per installation (vs 1,000 for the default GITHUB_TOKEN)
|
|
and are scoped to the App's installation permissions, not a user account.
|
|
|
|
Falls back to the built-in GITHUB_TOKEN when APP_CLIENT_ID is not set —
|
|
this happens on fork PRs where repo secrets are unavailable. The fallback
|
|
ensures classification, timings, and review comments still work on
|
|
forks (with the lower GITHUB_TOKEN rate limit).
|
|
|
|
Composite actions cannot access the secrets context directly, so the
|
|
calling workflow must pass secrets.APP_CLIENT_ID and secrets.APP_PRIVATE_KEY
|
|
as inputs. When both are empty (fork PRs), the fallback fires.
|
|
|
|
inputs:
|
|
client-id:
|
|
description: GitHub App Client ID. Pass secrets.APP_CLIENT_ID from the calling workflow.
|
|
required: false
|
|
default: ''
|
|
private-key:
|
|
description: GitHub App private key PEM. Pass secrets.APP_PRIVATE_KEY from the calling workflow.
|
|
required: false
|
|
default: ''
|
|
|
|
outputs:
|
|
token:
|
|
description: A GitHub App installation access token (1-hour TTL), or GITHUB_TOKEN on forks.
|
|
value: ${{ steps.app-token.outputs.token || steps.fallback.outputs.token }}
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Check if App credentials exist
|
|
id: check
|
|
shell: bash
|
|
env:
|
|
CLIENT_ID: ${{ inputs.client-id }}
|
|
run: |
|
|
if [ -n "$CLIENT_ID" ]; then
|
|
echo "has_app=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "has_app=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Create GitHub App token
|
|
id: app-token
|
|
if: steps.check.outputs.has_app == 'true'
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
|
|
with:
|
|
client-id: ${{ inputs.client-id }}
|
|
private-key: ${{ inputs.private-key }}
|
|
|
|
- name: Fall back to GITHUB_TOKEN
|
|
id: fallback
|
|
if: steps.check.outputs.has_app != 'true'
|
|
shell: bash
|
|
run: echo "token=${{ github.token }}" >> "$GITHUB_OUTPUT"
|