Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Create the GitHub App for board writes and security-alert reads, and store its credentials as org secrets

Aperta
  • Qualcosa non va?
#2,544 1 commento 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@cliffhall ci sta già lavorando.

Dal 20/10/2026.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
35/100
Tipo di issue
Funzionalità
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
github-actions
Ambito
ci-cd, security

Direzione di ricerca

Start with dependabot-alerts.yml and the sweep sections in AGENTS.md to identify the existing PROJECT_TOKEN usage and where the new secret names belong. Review the permissions table and the actions/create-github-app-token workflow step, then use a throwaway workflow_dispatch run to verify that the installed App can read the board. Done means the App is installed only on inspector, the listed org and repository permissions are exact, secrets are restricted to that repository, and the names are recorded in AGENTS.md.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

chore v2

Problem

Three planned automations write to the org project board or read security alerts, and all are blocked on the same missing credential: GHSA draft cards (#2462), nightly triage (#2463), and the security sweep (#2542). dependabot-alerts.yml already reads secrets.PROJECT_TOKEN, but the secret does not exist, so the daily sweep files issues it cannot board.

The built-in GITHUB_TOKEN cannot hold organization projects: write, so the board write needs a separate identity. The App's spec currently lives inside #2462's body; this issue gives the prerequisite its own card.

What to create

A GitHub App installed on the modelcontextprotocol org, on the inspector repository only. It is only an identity with permissions: no code and no server. Workflows mint a short-lived installation token from it on each run with actions/create-github-app-token.

Scope Permission Needed by
Organization Projects: read & write every board write (#2462, #2463, #2542, the Dependabot sweep)
Repository Issues: read & write filing, labeling and commenting on issues
Repository Repository security advisories: read GHSA draft cards (#2462)
Repository Dependabot alerts: read the Dependabot sweep (#2542)
Repository Code scanning alerts: read the code-scanning sweep (#2542)
Repository Administration: read makes the sweep's automated-security-fixes check a real assertion instead of UNVERIFIED

Grant nothing beyond this list. In particular: no Contents write, no Workflows, no Secrets.

Storage

  • The App id and private key go in org Actions secrets limited to the inspector repo (for example INSPECTOR_BOT_APP_ID and INSPECTOR_BOT_PRIVATE_KEY).
  • Record the chosen secret names in AGENTS.md, next to the sweep sections that consume them.

Notes

  • This is an org-admin act and stays human-gated. An agent cannot create or install the App.
  • The fallback is a fine-grained PAT with the same permissions, stored as PROJECT_TOKEN. It is quicker to set up, but it is tied to one person and must be rotated by hand. The App is preferred.

Acceptance

  • App created and installed on inspector only, with exactly the permissions above
  • App id and private key stored as org Actions secrets limited to inspector
  • Secret names recorded in AGENTS.md
  • A throwaway workflow_dispatch run mints a token and reads the board, proving the install before the sweeps depend on it

Part of tracker #2543. Every board-writing sub-issue there is blocked on this one.

Lingua principale
TypeScript
Stelle
11.2k
Fork
1.6k
Merge medio
4h 56m
PR unite (30g)
155

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di modelcontextprotocol/inspector

Tutte le issue di modelcontextprotocol/inspector

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.