From fa85ddab1d0ea7ee20bedcfebc4cd59307f3f89e Mon Sep 17 00:00:00 2001 From: Lukas Klingsbo Date: Fri, 28 Aug 2026 16:34:18 +0200 Subject: [PATCH] ci!: use client-id instead of deprecated app-id for app tokens actions/create-github-app-token deprecated the 'app-id' input in favour of 'client-id', which emitted a warning on every 'Generate token' step (twice per step, once for main and once for post). The release workflow now reads the Supabase Releaser client ID from the new GH_APP_CLIENT_ID repository variable. Client IDs are public app metadata, so a variable is a better fit than a secret. The reusable sync-sdk-compliance workflow drops its optional 'app-id' secret input and requires 'client-id'. Callers pinned to earlier SHAs keep working; callers bumping to this revision must pass 'client-id'. --- .github/workflows/release.yml | 2 +- .github/workflows/sync-sdk-compliance.yml | 8 ++------ 2 files changed, 3 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 01f72b3..121df5a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -29,7 +29,7 @@ jobs: id: app-token uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: - app-id: ${{ secrets.APP_ID }} + client-id: ${{ vars.GH_APP_CLIENT_ID }} private-key: ${{ secrets.PRIVATE_KEY }} - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0 diff --git a/.github/workflows/sync-sdk-compliance.yml b/.github/workflows/sync-sdk-compliance.yml index 005926b..6b16e72 100644 --- a/.github/workflows/sync-sdk-compliance.yml +++ b/.github/workflows/sync-sdk-compliance.yml @@ -12,12 +12,9 @@ on: type: string default: main secrets: - app-id: - description: GitHub App ID used to open the pull request (provide this or client-id) - required: false client-id: - description: GitHub App client ID used to open the pull request (provide this or app-id) - required: false + description: GitHub App client ID used to open the pull request + required: true private-key: description: GitHub App private key used to open the pull request required: true @@ -67,7 +64,6 @@ jobs: id: app-token uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: - app-id: ${{ secrets.app-id }} client-id: ${{ secrets.client-id }} private-key: ${{ secrets.private-key }}