Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[quality] push-repacked-dist cannot mint its App token: Dependabot secrets REPACK_APP_ID / REPACK_APP_PRIVATE_KEY are not configured

Open
  • Is something wrong?
#452 2 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 2 days

Nobody has claimed this yet.

Assessment

Difficulty
1/5
Estimated time
Under an hour
Newbie friendliness
25/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
github-actions, typescript, yaml
Domain
ci-cd

Research direction

Read .github/workflows/test.yml lines 115–123 and the linked failure from PR #440 to confirm the missing Dependabot secrets. The issue says resolution requires a maintainer with repository settings access: add the two secrets and rerun build-test, or decide to remove the job. Done means the chosen action is completed and the check no longer fails for this reason.

Written by the indexing model from the issue text.

Description

agent/quality hive/hosted-available-lke648397-260827-5q9t needs-decision needs-kind quality testing

Finding

.github/workflows/test.yml:115-123 (push-repacked-dist, added by #390 / 15802ac) runs actions/create-github-app-token with

app-id: ${{ secrets.REPACK_APP_ID }}
private-key: ${{ secrets.REPACK_APP_PRIVATE_KEY }}

On dependabot branches the step reads Dependabot secrets, and those two have never been configured. Latest evidence, PR #440 (js-yaml 5.4.2 → 5.4.3, run 38068101038):

  • repack-dist succeeded with changed=true and uploaded the artifact — the job pair works.
  • push-repacked-dist failed at step 1: "The 'client-id' (or deprecated 'app-id') input must be set to a non-empty string. If using a secret or variable, ensure it is available in this workflow context."
  • build-test therefore stays red on the "Verify committed dist/ matches source" gate, exactly the #171 class that #390 was meant to retire.

This was previously recorded only as a folded comment on #422, which was closed on 2026-10-11 without the secrets being added, so nothing open tracks it now. Every future dependabot bump of an ncc-bundled runtime dependency (js-yaml, @actions/*, …) will reproduce it.

Recommendation

No repository change can fix this; it needs a maintainer with repo-settings access (needs-human: Dependabot secrets are not writable by any agent or workflow). Please choose one:

  • (preferred) Add REPACK_APP_ID and REPACK_APP_PRIVATE_KEY under Settings → Secrets and variables → Dependabot (same values as the Actions-scoped App used by prow-bot.yml, or a dedicated App with contents: write on this repo), then re-run build-test on #440 to confirm push-repacked-dist pushes the repacked dist/.
  • Or decide that bundled-dep dependabot PRs are hand-repacked (as for #188 via 7e70949) and remove the push-repacked-dist job so it stops reporting a red check on every such PR.

Priority

  • Impact: medium (every bundled-dep dependabot PR is permanently red until a human intervenes)
  • Effort: low (two secrets)

Filed by quality agent (hold-gated mode)

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: ab87871

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

Dominant language
TypeScript
Stars
132
Forks
23
Avg merge
1d 19h
Merged PRs (30d)
166

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from cncf/prow-github-actions

All issues in cncf/prow-github-actions

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.