Summary
actions/create-github-app-token@v3 has soft-deprecated the app-id input in
favor of client-id. Every workflow run that mints a pinpredict-argocd App
token now logs:
Input 'app-id' has been deprecated with message: Use 'client-id' instead.
Non-blocking — app-id still works and tokens still mint; this is warning
noise, surfaced org-wide on any repo that touches the shared CI plumbing (first
noticed on a pinpredict/legate tag-config run).
Affected usages
app-id: ${{ secrets.BOOTSTRAP_APP_ID }} appears in:
pinpredict/.github
.github/workflows/tag-config.yml.github/workflows/docker-release.ymlactions/setup-go/action.yml (composite — 2 usages)
pinpredict/platform-gitops
.github/workflows/bootstrap-service-state.yaml
- Consumer repos — each repo's local
create-github-app-token step
(e.g. the validate-platform-services job in legate/herald/… ci.yml).
Why it's not a drive-by fix
client-id expects the App's OAuth client ID (Iv23li…), which is a
different value from the numeric App ID (3187934) held in BOOTSTRAP_APP_ID.
Swapping app-id:→client-id: while still feeding the numeric App ID makes the
token mint fail, turning a harmless warning into a hard failure everywhere.
A new secret must be seeded first.
Fix plan
- Retrieve the
pinpredict-argocd App's Client ID (App settings → General →
Client ID).
- Add org Actions secret
BOOTSTRAP_APP_CLIENT_ID, scoped to the same repo
set as BOOTSTRAP_APP_ID / BOOTSTRAP_APP_PRIVATE_KEY (currently 17 repos).
- Swap
app-id: ${{ secrets.BOOTSTRAP_APP_ID }} →
client-id: ${{ secrets.BOOTSTRAP_APP_CLIENT_ID }} across the workflows/
composite above (private-key input is unchanged).
- Roll the consumer-repo local usages (can lag; warning-only until done).
- Once all callers are migrated, optionally retire
BOOTSTRAP_APP_ID.
Acceptance
No app-id has been deprecated warnings in tag-config / docker-release / setup-go
/ bootstrap runs; token mint still succeeds.
Summary
actions/create-github-app-token@v3has soft-deprecated theapp-idinput infavor of
client-id. Every workflow run that mints apinpredict-argocdApptoken now logs:
Non-blocking —
app-idstill works and tokens still mint; this is warningnoise, surfaced org-wide on any repo that touches the shared CI plumbing (first
noticed on a
pinpredict/legatetag-config run).Affected usages
app-id: ${{ secrets.BOOTSTRAP_APP_ID }}appears in:pinpredict/.github.github/workflows/tag-config.yml.github/workflows/docker-release.ymlactions/setup-go/action.yml(composite — 2 usages)pinpredict/platform-gitops.github/workflows/bootstrap-service-state.yamlcreate-github-app-tokenstep(e.g. the
validate-platform-servicesjob inlegate/herald/…ci.yml).Why it's not a drive-by fix
client-idexpects the App's OAuth client ID (Iv23li…), which is adifferent value from the numeric App ID (
3187934) held inBOOTSTRAP_APP_ID.Swapping
app-id:→client-id:while still feeding the numeric App ID makes thetoken mint fail, turning a harmless warning into a hard failure everywhere.
A new secret must be seeded first.
Fix plan
pinpredict-argocdApp's Client ID (App settings → General →Client ID).
BOOTSTRAP_APP_CLIENT_ID, scoped to the same reposet as
BOOTSTRAP_APP_ID/BOOTSTRAP_APP_PRIVATE_KEY(currently 17 repos).app-id: ${{ secrets.BOOTSTRAP_APP_ID }}→client-id: ${{ secrets.BOOTSTRAP_APP_CLIENT_ID }}across the workflows/composite above (private-key input is unchanged).
BOOTSTRAP_APP_ID.Acceptance
No
app-id has been deprecatedwarnings in tag-config / docker-release / setup-go/ bootstrap runs; token mint still succeeds.