Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Move the danielridgebot workflows off secrets.DR_PAT onto the org GitHub App

オープン
  • 何か問題がありますか？
#223 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
48/100
issue の種類
機能追加
明瞭さ
おおむね明確
活発さ
活発
技術スタック
github, github-actions
領域
ci-cd, devops, security

調査の方向性

hackforla/check-ghpages-versions の check-gh-pages-version.yml、check-ruby-version.yml、test-issue-labels.yml から始め、既存の DR_PAT の使用方法と create-github-app-token action を確認する。使い捨てのブランチから gh workflow run check-gh-pages-version.yml --ref でテストし、その後、テスト用の issue と card をクリーンアップする前に、ラベル、milestone、board 73 を確認する。両方の check が App token で動作し、DR_PAT に関する判断が記録されていれば完了とする。

索引モデルが issue の本文から書いたものです。

説明

complexity: medium feature: security role: DevOps Engineer size: 3pt
Overview

We need the danielridgebot workflows to create issues with a token minted from the org's GitHub App instead of secrets.DR_PAT, because that PAT is a personal access token on a recurring expiry cycle with nothing warning us when it lapses. Its failure mode is silence — a missed GitHub Pages version bump rather than an alert — so we would not find out until someone noticed the bot had gone quiet.

Action Items
  • Confirm first that the HFLA_WORKFLOW_APP_* App is installed on hackforla/devops with Issues: write, and that it has organization Projects: write. The bot creates its issues on hackforla/devops and adds them to board 73, so an installation scoped only to the bot repo is not enough. If the App cannot write to projects, that is the finding — record it on this issue rather than shipping something that silently stops adding board cards.
  • In check-gh-pages-version.yml and check-ruby-version.yml, mint a token with actions/create-github-app-token from secrets.HFLA_WORKFLOW_APP_ID / secrets.HFLA_WORKFLOW_APP_PRIVATE_KEY and pass it as GH_TOKEN to the "Create issue…" step, in place of secrets.DR_PAT. Both org secrets are already readable by this repo — verified 2026-09-07.
  • Leave the git push steps alone. They commit the new version file using the checkout-persisted GITHUB_TOKEN, not DR_PAT, so they are unaffected by this change.
  • Decide what happens to test-issue-labels.yml, the third and last user of DR_PAT: switch it too, or delete it. It is workflow_dispatch-only, it opens issues on the bot repo itself, and the one it left behind — check-ghpages-versions#22, open since May 2024 — is that repo's only open issue, so nothing sweeps what it creates.
  • Test before relying on it. On a throwaway branch, set release-versions/github-pages-gem.txt to an older value and run gh workflow run check-gh-pages-version.yml --ref <branch>. The workflow commits the real version back, so the file self-restores — but it opens a real issue on hackforla/devops with a board card, so close that issue and delete its card afterwards.
  • Check the test issue carries its labels, its milestone and a card on board 73. The board card is both the most likely thing to fail and the one that fails quietly.
  • Once both check workflows are confirmed working on App tokens, delete the DR_PAT repo secret. Decide separately what happens to the danielridgebot user account itself — with the PAT retired it has no remaining job.
  • Note that the issue author changes from danielridgebot to the App's bot identity. Nothing we know of filters on the author, but the weekly label check and anyone reading the board will see a different name — confirm that is acceptable before merging rather than after.
Resources/Instructions
  • The change is a PR on hackforla/check-ghpages-versions. This issue lives on devops because that is where the bot's issues land, where it is documented, and because the bot repo is not on board 73 and has almost no label vocabulary of its own.
  • The bot's documentation: @danielridgebot-DevOps-Wiki
  • DR_PAT was last rotated 2025-10-26 and confirmed working 2026-08-24, so it is currently valid. This is not urgent — it removes a recurring liability rather than fixing an outage.
  • Org secrets already visible to the bot repo, verified 2026-09-07: HFLA_WORKFLOW_APP_ID, HFLA_WORKFLOW_APP_PRIVATE_KEY, HFLA_GRAPHQL_APP_ID, HFLA_GRAPHQL_APP_PRIVATE_KEY.
  • Do not "fix" the issue templates' frontmatter while you are in there. update-gh-pages-version.md and update-ruby-version.md carry projects: as a board title and milestones: plural. GitHub never renders these files — the bot's own parser, github-actions/utils/parse-issue-template.js, reads the frontmatter and feeds it to gh issue create --project "$PROJECTS", where a board title is exactly what is wanted. Changing them to hackforla/73 would break the bot.
  • Do not delete keepalive.yml. It looks like dead code and is load-bearing: GitHub disables scheduled workflows after 60 days with no repository commits, which is what silently killed both checks between 2026-01-07 and 2026-08-24. It is hand-rolled because the action the wiki recommends for this has been blocked by GitHub since 2025-04-21.
主要言語
PowerShell
スター
8
フォーク
10
平均マージ
7時間 30分
マージ済み PR（30日）
22

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

hackforla/devops のほかの issue

hackforla/devops の issue をすべて見る

似ている issue

DevOps の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。