From e7d7ad948cc2057bb821bf5e0cad07cdda63fdd1 Mon Sep 17 00:00:00 2001 From: Leif Date: Tue, 14 Jul 2026 12:48:14 -0700 Subject: [PATCH 1/2] ci: swap docker JWT pattern for actions/create-github-app-token Replaces the older `docker://public.ecr.aws/y9k7q4m1/devops/cicd:latest` JWT-fetch + `curl` token pattern with `actions/create-github-app-token` for the semgrep-ci GitHub App in the autoapprove workflow. Equivalent of semgrep/duplo#246 for this repo. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/autoapprove.yml | 21 +++++---------------- 1 file changed, 5 insertions(+), 16 deletions(-) diff --git a/.github/workflows/autoapprove.yml b/.github/workflows/autoapprove.yml index a8b9d2c..8b3fbf9 100644 --- a/.github/workflows/autoapprove.yml +++ b/.github/workflows/autoapprove.yml @@ -36,24 +36,13 @@ jobs: # move the tag we created in bump_version.yml from the # release branch to develop - - id: jwt - env: - EXPIRATION: 600 - ISSUER: ${{ secrets.SEMGREP_CI_APP_ID }} - PRIVATE_KEY: ${{ secrets.SEMGREP_CI_APP_KEY }} - name: Get JWT for semgrep-ci GitHub App - uses: docker://public.ecr.aws/y9k7q4m1/devops/cicd:latest - - id: token name: Get token for semgrep-ci GitHub App - run: | - TOKEN="$(curl -X POST \ - -H "Authorization: Bearer ${{ steps.jwt.outputs.jwt }}" \ - -H "Accept: application/vnd.github.v3+json" \ - "https://api.github.com/app/installations/${{ secrets.SEMGREP_CI_APP_INSTALLATION_ID }}/access_tokens" | \ - jq -r .token)" - echo "::add-mask::$TOKEN" - echo "token=$TOKEN" >> $GITHUB_OUTPUT + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.SEMGREP_CI_CLIENT_ID }} + private-key: ${{ secrets.SEMGREP_CI_APP_KEY }} + owner: ${{ github.repository_owner }} - uses: actions/checkout@v4 with: From 21f18150f5b0a75ecf57e8348c748cc79bb453c4 Mon Sep 17 00:00:00 2001 From: Leif Date: Tue, 14 Jul 2026 12:49:38 -0700 Subject: [PATCH 2/2] Change SEMGREP_CI_CLIENT_ID to use secrets --- .github/workflows/autoapprove.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/autoapprove.yml b/.github/workflows/autoapprove.yml index 8b3fbf9..776db44 100644 --- a/.github/workflows/autoapprove.yml +++ b/.github/workflows/autoapprove.yml @@ -40,7 +40,7 @@ jobs: name: Get token for semgrep-ci GitHub App uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: - client-id: ${{ vars.SEMGREP_CI_CLIENT_ID }} + client-id: ${{ secrets.SEMGREP_CI_CLIENT_ID }} private-key: ${{ secrets.SEMGREP_CI_APP_KEY }} owner: ${{ github.repository_owner }}