ci: use dedicated GitHub App token instead of shared PAT#1351
Conversation
Replace GH_TOKEN_PULL_REQUESTS (shared org PAT) with a dedicated GitHub App token to avoid rate limiting from noisy neighbors. The app token is generated per-run via actions/create-github-app-token, providing its own rate limit bucket and short-lived credentials.
|
🧪 E2E Test Results❌ Some tests failed Summary
❌ Failed Tests🐘 Local Postgres (1 failed)nextjs-webpack-stable (1 failed):
🌍 Community Worlds (56 failed)mongodb (3 failed):
redis (2 failed):
turso (51 failed):
Details by Category✅ ▲ Vercel Production
✅ 💻 Local Development
✅ 📦 Local Production
❌ 🐘 Local Postgres
✅ 🪟 Windows
❌ 🌍 Community Worlds
✅ 📋 Other
❌ Some E2E test jobs failed:
Check the workflow run for details. |
📊 Benchmark Results
workflow with no steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Next.js (Turbopack) | Express workflow with 1 step💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Next.js (Turbopack) | Express workflow with 10 sequential steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Next.js (Turbopack) | Express workflow with 25 sequential steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) | Express | Nitro workflow with 50 sequential steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Express | Next.js (Turbopack) Promise.all with 10 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Express | Next.js (Turbopack) Promise.all with 25 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Next.js (Turbopack) | Express Promise.all with 50 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Express | Next.js (Turbopack) Promise.race with 10 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Next.js (Turbopack) | Express Promise.race with 25 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) Promise.race with 50 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) | Express | Nitro Stream Benchmarks (includes TTFB metrics)workflow with stream💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Next.js (Turbopack) | Express SummaryFastest Framework by WorldWinner determined by most benchmark wins
Fastest World by FrameworkWinner determined by most benchmark wins
Column Definitions
Worlds:
|
There was a problem hiding this comment.
Pull request overview
Updates the repo’s release-related GitHub Actions workflows to stop using a shared long-lived PAT and instead generate short-lived, per-run GitHub App installation tokens to reduce rate-limit contention and improve credential hygiene.
Changes:
- Added
actions/create-github-app-token@v1steps to generate a GitHub App token during workflow execution. - Replaced prior
GH_TOKEN_PULL_REQUESTSusage with the generated token for checkout and GitHub API interactions. - Extended the dispatch workflow token to cover cross-repo access to
vercel/workflowandvercel/front.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| .github/workflows/release.yml | Generates a GitHub App token per run and uses it for checkout, Changesets PR/release operations, and gh release creation. |
| .github/workflows/dispatch-front-workflow-release-pr.yml | Generates a GitHub App token per job with access to workflow,front and uses it for actions/github-script dispatch calls. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
VaguelySerious
left a comment
There was a problem hiding this comment.
Let's give it a shot with the next release PR, could go out today
…ignal * origin/main: fix: separate infrastructure vs user code error handling (#1339) Revert "Fix e2e CLI SIGTERM flake: use SIGKILL to reliably kill hung processes" Fix e2e CLI SIGTERM flake: use SIGKILL to reliably kill hung processes ci: fix git identity for changesets Version Packages commit (#1357) ci: configure git identity for GitHub App bot account (#1356) fix(cli): remove short flag collision on `-e` in health command (#1343) Fix flaky Vercel prod e2e tests by skipping CLI update check (#1350) Fix Windows `ERR_UNSUPPORTED_ESM_URL_SCHEME` in dynamic imports (#1346) Fix flaky hook test by replacing setTimeout with deterministic awaits (#1347) ci: use dedicated GitHub App token instead of shared PAT (#1351) [world-local] Enforce hook token uniqueness and atomicity, matches other worlds (#1348) fix(core): suppress stale WORKFLOW_VERCEL_* env var warning outside serverless runtime (#1345) # Conflicts: # packages/core/src/runtime/step-handler.ts
Summary
GH_TOKEN_PULL_REQUESTSPAT with a dedicated GitHub App token generated per-run viaactions/create-github-app-token[bot]badge on PRs/commitsChanges
.github/workflows/release.ymlGenerate GitHub App Tokenstep usingRELEASE_APP_IDandRELEASE_APP_PRIVATE_KEYsecretsGH_TOKEN_PULL_REQUESTSreferences (checkout, changesets action, GitHub release creation).github/workflows/dispatch-front-workflow-release-pr.ymlGenerate GitHub App Tokenstep to bothdispatch-front-syncanddispatch-front-closejobs with cross-repo access tovercel/workflowandvercel/frontGH_TOKEN_PULL_REQUESTSreferencesPrerequisites
The following have already been set up:
vercel/workflowandvercel/frontRELEASE_APP_IDandRELEASE_APP_PRIVATE_KEYrepository secrets configuredFollow-up
GH_TOKEN_PULL_REQUESTSsecret from this repo once verified working