Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Move the Dependabot alert sweep from the nonexistent PROJECT_TOKEN to the GitHub App token

Abierto
  • ¿Algo no está bien?
#2,547 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
52/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
github-actions
Área
ci-cd, devops

Línea de trabajo

Start with .github/workflows/dependabot-alerts.yml around line 103 and the related references in AGENTS.md; confirm the GitHub App from #2544 is available before changing the token flow. Check the workflow's fallback and run verify:action-pins, then validate that a test alert is both filed and placed on board #28 at Todo/High, while missing App secrets still produce the triage hand-off.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

blocked chore v2

Problem

.github/workflows/dependabot-alerts.yml (line 103) passes secrets.PROJECT_TOKEN to the sweep, so that it can place each filed issue on board #28 at Todo / High. That secret has never existed, so every run degrades to filing a labeled, milestoned issue that waits for manual /issue-triage.

Change

Once the GitHub App exists (#2544), switch the workflow to it:

  • Add an actions/create-github-app-token step, SHA-pinned (verify:action-pins, #2484), that mints an installation token from the App id and private key secrets.
  • Pass that token to the sweep in place of PROJECT_TOKEN, and delete the PROJECT_TOKEN path and its references in the workflow comments and AGENTS.md.
  • Keep the degrade-to-triage fallback, so a run with the secret missing (a fork, for example) still files issues and stays green.
  • Consider moving the alert read to the App as well (Dependabot alerts: read) so the sweep runs under one identity. The workflow's vulnerability-alerts: read already works, so this is optional.

Acceptance

  • A scheduled or dispatched run files a test alert's issue and boards it at Todo / High on #28
  • With the App secrets absent, the run still files the issue and logs the triage hand-off
  • verify:action-pins passes, and no PROJECT_TOKEN reference remains

Blocked on

#2544 (the GitHub App). Part of tracker #2543.

Lenguaje dominante
TypeScript
Estrellas
11.1k
Forks
1.5k
Merge medio
4 h 32 min
PR fusionados (30 d)
136

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de modelcontextprotocol/inspector

Todos los issues de modelcontextprotocol/inspector

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.