Move app_id from secret to input; fix duplicate with: blocks

app_id is not sensitive (it's a numeric identifier visible on the App
settings page), so it's better as a repo variable than a secret.

Consumers set:
- Variable: REPO_SYNC_APP_ID (via vars)
- Secret: REPO_SYNC_APP_PRIVATE_KEY (via secrets)

Co-Authored-By: Oz <oz-agent@warp.dev>

Author: vorporeal

.github/workflows/escalation.yml

@@ -31,10 +31,11 @@ on:
         description: "Private repo (e.g. warpdotdev/warp-internal)."
         required: true
         type: string
-    secrets:
       app_id:
         description: "GitHub App ID."
         required: true
+        type: string
+    secrets:
       app_private_key:
         description: "GitHub App private key."
         required: true
@@ -54,7 +55,7 @@ jobs:
         id: token
         uses: actions/create-github-app-token@v1
         with:
-          app-id: ${{ secrets.app_id }}
+          app-id: ${{ inputs.app_id }}
           private-key: ${{ secrets.app_private_key }}
           owner: ${{ github.repository_owner }}
       - run: echo "GH_TOKEN=${{ steps.token.outputs.token }}" >> "$GITHUB_ENV"

.github/workflows/restack.yml

@@ -24,10 +24,11 @@ on:
         required: false
         type: string
         default: "@oncall-client-primary"
-    secrets:
       app_id:
         description: "GitHub App ID."
         required: true
+        type: string
+    secrets:
       app_private_key:
         description: "GitHub App private key."
         required: true
@@ -81,7 +82,7 @@ jobs:
         id: token
         uses: actions/create-github-app-token@v1
         with:
-          app-id: ${{ secrets.app_id || secrets.REPO_SYNC_APP_ID }}
+          app-id: ${{ inputs.app_id }}
           private-key: ${{ secrets.app_private_key || secrets.REPO_SYNC_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
       - name: Set GH_TOKEN

.github/workflows/sync.yml

@@ -25,10 +25,11 @@ on:
         required: false
         type: string
         default: ""
-    secrets:
       app_id:
         description: "GitHub App ID."
         required: true
+        type: string
+    secrets:
       app_private_key:
         description: "GitHub App private key."
         required: true
@@ -48,7 +49,7 @@ jobs:
         id: token
         uses: actions/create-github-app-token@v1
         with:
-          app-id: ${{ secrets.app_id }}
+          app-id: ${{ inputs.app_id }}
           private-key: ${{ secrets.app_private_key }}
           owner: ${{ github.repository_owner }}
       - uses: actions/checkout@v4

README.md

@@ -103,7 +103,7 @@ on:
   schedule:
     - cron: "*/15 * * * *"      # triggers escalation checks
 
-# store the GitHub App installation token as REPO_SYNC_TOKEN in repo secrets.
+# store REPO_SYNC_APP_ID as a variable and REPO_SYNC_APP_PRIVATE_KEY as a secret.
 # each job only runs when its trigger condition matches, so no wasted runs.
 
 jobs:
@@ -113,8 +113,8 @@ jobs:
     with:
       public_repo: warpdotdev/warp-public
       private_repo: warpdotdev/warp-internal
+      app_id: ${{ vars.REPO_SYNC_APP_ID }}
     secrets:
-      app_id: ${{ secrets.REPO_SYNC_APP_ID }}
       app_private_key: ${{ secrets.REPO_SYNC_APP_PRIVATE_KEY }}
 
   restack:
@@ -123,8 +123,8 @@ jobs:
     with:
       public_repo: warpdotdev/warp-public
       private_repo: warpdotdev/warp-internal
+      app_id: ${{ vars.REPO_SYNC_APP_ID }}
     secrets:
-      app_id: ${{ secrets.REPO_SYNC_APP_ID }}
       app_private_key: ${{ secrets.REPO_SYNC_APP_PRIVATE_KEY }}
 
   escalation:
@@ -135,8 +135,8 @@ jobs:
       escalate_after: "1h"
       public_repo: warpdotdev/warp-public
       private_repo: warpdotdev/warp-internal
+      app_id: ${{ vars.REPO_SYNC_APP_ID }}
     secrets:
-      app_id: ${{ secrets.REPO_SYNC_APP_ID }}
       app_private_key: ${{ secrets.REPO_SYNC_APP_PRIVATE_KEY }}
 ```
 

examples/consuming-repo-sync.yml

@@ -44,9 +44,9 @@ jobs:
       public_repo: warpdotdev/warp-public
       private_repo: warpdotdev/warp-internal
       escalate_to: "@oncall-client-primary"
+      app_id: ${{ vars.REPO_SYNC_APP_ID }}
       # slack_webhook_url: ${{ secrets.REPO_SYNC_SLACK_WEBHOOK }}
     secrets:
-      app_id: ${{ secrets.REPO_SYNC_APP_ID }}
       app_private_key: ${{ secrets.REPO_SYNC_APP_PRIVATE_KEY }}
 
   # -----------------------------------------------------------------------
@@ -62,8 +62,8 @@ jobs:
       public_repo: warpdotdev/warp-public
       private_repo: warpdotdev/warp-internal
       escalate_to: "@oncall-client-primary"
+      app_id: ${{ vars.REPO_SYNC_APP_ID }}
     secrets:
-      app_id: ${{ secrets.REPO_SYNC_APP_ID }}
       app_private_key: ${{ secrets.REPO_SYNC_APP_PRIVATE_KEY }}
 
   # -----------------------------------------------------------------------
@@ -77,6 +77,6 @@ jobs:
       escalate_after: "1h"
       public_repo: warpdotdev/warp-public
       private_repo: warpdotdev/warp-internal
+      app_id: ${{ vars.REPO_SYNC_APP_ID }}
     secrets:
-      app_id: ${{ secrets.REPO_SYNC_APP_ID }}
       app_private_key: ${{ secrets.REPO_SYNC_APP_PRIVATE_KEY }}