From a780227f35b3dbf41a3f927d3f06d59c232b9fad Mon Sep 17 00:00:00 2001 From: "V. David Zvenyach" Date: Mon, 19 Oct 2026 17:30:36 -0500 Subject: [PATCH] ci(docs-dispatch): mint the dispatchbot token with client-id `actions/create-github-app-token` v3 deprecates `app-id`, so the mint step now passes the App's Client ID from the `DISPATCHBOT_CLIENT_ID` org variable. The header names the variable and the private-key secret as the required settings. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/docs-dispatch.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/docs-dispatch.yml b/.github/workflows/docs-dispatch.yml index b9a168d..82cfc5d 100644 --- a/.github/workflows/docs-dispatch.yml +++ b/.github/workflows/docs-dispatch.yml @@ -8,9 +8,9 @@ name: Docs dispatch # tango-node is a `coloc-source` repo: its docs/ folder is the authoritative # source for the Node SDK pages on docs.makegov.com (see makegov/docs#15). # -# Required secrets — both are ORG secrets with `visibility: selected`, so this repo has to be on their selected list or every dispatch fails auth: -# DISPATCHBOT_APP_ID — the makegov-dispatchbot App. -# DISPATCHBOT_PRIVATE_KEY — its private key. +# Required org settings for the makegov-dispatchbot App: +# DISPATCHBOT_CLIENT_ID — org variable: the App's Client ID, visible to all repos. +# DISPATCHBOT_PRIVATE_KEY — org secret: its private key. The secret has `visibility: selected`, so this repo has to be on its selected list or every dispatch fails auth. # # The App mints a short-lived installation token scoped to the one repo this dispatches to (makegov/docs unless DOCS_TARGET_REPO overrides it). # @@ -93,7 +93,7 @@ jobs: id: docs_composer uses: actions/create-github-app-token@v3 with: - app-id: ${{ secrets.DISPATCHBOT_APP_ID }} + client-id: ${{ vars.DISPATCHBOT_CLIENT_ID }} private-key: ${{ secrets.DISPATCHBOT_PRIVATE_KEY }} owner: ${{ steps.docs_target.outputs.owner }} # Scoped to the single repo this step dispatches to, so a leaked token can't reach the rest of the org. A repository_dispatch needs Contents:write on the receiving repo.