Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[quality] push-repacked-dist cannot mint its App token: Dependabot secrets REPACK_APP_ID / REPACK_APP_PRIVATE_KEY are not configured

Cerrado
  • ¿Algo no está bien?
#452 3 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 2 días

Ya se ha fusionado un pull request relacionado.

  • #489 de @jeefy — fusionado

Evaluación

Dificultad
1/5
Tiempo estimado
Menos de una hora
Aptitud para principiantes
25/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
github-actions, typescript, yaml
Área
ci-cd

Línea de trabajo

Read .github/workflows/test.yml lines 115–123 and the linked failure from PR #440 to confirm the missing Dependabot secrets. The issue says resolution requires a maintainer with repository settings access: add the two secrets and rerun build-test, or decide to remove the job. Done means the chosen action is completed and the check no longer fails for this reason.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

agent/quality hive/hosted-available-lke648397-260827-5q9t needs-decision needs-kind quality testing

Finding

.github/workflows/test.yml:115-123 (push-repacked-dist, added by #390 / 15802ac) runs actions/create-github-app-token with

app-id: ${{ secrets.REPACK_APP_ID }}
private-key: ${{ secrets.REPACK_APP_PRIVATE_KEY }}

On dependabot branches the step reads Dependabot secrets, and those two have never been configured. Latest evidence, PR #440 (js-yaml 5.4.2 → 5.4.3, run 38068101038):

  • repack-dist succeeded with changed=true and uploaded the artifact — the job pair works.
  • push-repacked-dist failed at step 1: "The 'client-id' (or deprecated 'app-id') input must be set to a non-empty string. If using a secret or variable, ensure it is available in this workflow context."
  • build-test therefore stays red on the "Verify committed dist/ matches source" gate, exactly the #171 class that #390 was meant to retire.

This was previously recorded only as a folded comment on #422, which was closed on 2026-10-11 without the secrets being added, so nothing open tracks it now. Every future dependabot bump of an ncc-bundled runtime dependency (js-yaml, @actions/*, …) will reproduce it.

Recommendation

No repository change can fix this; it needs a maintainer with repo-settings access (needs-human: Dependabot secrets are not writable by any agent or workflow). Please choose one:

  • (preferred) Add REPACK_APP_ID and REPACK_APP_PRIVATE_KEY under Settings → Secrets and variables → Dependabot (same values as the Actions-scoped App used by prow-bot.yml, or a dedicated App with contents: write on this repo), then re-run build-test on #440 to confirm push-repacked-dist pushes the repacked dist/.
  • Or decide that bundled-dep dependabot PRs are hand-repacked (as for #188 via 7e70949) and remove the push-repacked-dist job so it stops reporting a red check on every such PR.

Priority

  • Impact: medium (every bundled-dep dependabot PR is permanently red until a human intervenes)
  • Effort: low (two secrets)

Filed by quality agent (hold-gated mode)

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: ab87871

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

Lenguaje dominante
TypeScript
Estrellas
132
Forks
24
Merge medio
1 d 12 h
PR fusionados (30 d)
229

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de cncf/prow-github-actions

Todos los issues de cncf/prow-github-actions

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.