Skip to content

Update popular_actions.go for actions/create-github-app-token@v3#668

Open
esaari wants to merge 1 commit into
rhysd:mainfrom
esaari:update-create-github-app-token-v3
Open

Update popular_actions.go for actions/create-github-app-token@v3#668
esaari wants to merge 1 commit into
rhysd:mainfrom
esaari:update-create-github-app-token-v3

Conversation

@esaari
Copy link
Copy Markdown

@esaari esaari commented May 21, 2026

Closes #669.

What

Regenerate the v3 entry in popular_actions.go for
actions/create-github-app-token
to match its current upstream action.yml.

Diff:

  • app-id — was required: true; now required: false with deprecationMessage: "Use 'client-id' instead."
  • client-id — added (canonical replacement for app-id)
  • enterprise — added
  • permission-artifact-metadata — added
  • permission-attestations — added
  • permission-discussions — added
  • permission-merge-queues — added

v1 and v2 schemas were verified against their respective live action.yml files
and left untouched — those tags ship app-id only and don't need any change.

Why

The bundled v3 schema still requires app-id and doesn't know about client-id.
On any workflow using the canonical input, actionlint produces two false-positives
per with: block:

missing input "app-id" which is required by action "actions/create-github-app-token@v3"
input "client-id" is not defined in action "actions/create-github-app-token@v3"

actions/create-github-app-token@v3 was published 2025-09 with client-id as the
canonical input; teams adopting the supported input get this false-positive pair
on every call site. Full repro and root cause in #669.

Generation method

I tried the full regen first
(go run ./scripts/generate-popular-actions ./popular_actions.go),
but it currently fails on an unrelated 404:

request was not successful https://raw.githubusercontent.com/actions-cool/issues-helper/v1/action.yml: 404 Not Found
exit status 1

actions-cool/issues-helper appears to have moved/deleted its v1 tag upstream.
This is also blocking the weekly auto-refresh workflow from updating any entry —
worth a follow-up to make the generator tolerant of upstream 404s, but out of
scope for this PR. I scoped the regen to just the affected action via a
single-entry registry:

go run ./scripts/generate-popular-actions \
  -r /tmp/cgat-registry.json -q

(where /tmp/cgat-registry.json contains only the actions/create-github-app-token
slug). The output was then patched into the existing popular_actions.go in place.
The resulting diff is byte-for-byte what the full regenerator would produce for
this entry — no manual edits to the generated formatting.

Verification

  • go build ./... — pass
  • go test -run TestPopularActionsDataset ./... — pass
  • go test ./... — pass

The action's v3 action.yml added `client-id` as the canonical input,
deprecating `app-id`, and added several new inputs (`enterprise`,
`permission-artifact-metadata`, `permission-attestations`,
`permission-discussions`, `permission-merge-queues`).

The bundled v3 schema still marked `app-id` as required and did not
know about `client-id`, producing two false-positives per `with:` block
on workflows that use the canonical input:

  - `missing input "app-id" which is required by action ...`
  - `input "client-id" is not defined in action ...`

Regenerated via:

  go run ./scripts/generate-popular-actions \
    -r /tmp/single-entry-registry.json -q

against a single-entry registry containing only this slug (the full
default-registry regen currently fails on an unrelated 404 for a
deleted upstream tag — `actions-cool/issues-helper@v1`).

v1 and v2 entries were verified against their current action.yml and
left untouched — those tags ship `app-id` only.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

False-positive on actions/create-github-app-token@v3 client-id input

1 participant