Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Create the GitHub App for board writes and security-alert reads, and store its credentials as org secrets

オープン
  • 何か問題がありますか？
#2,544 コメント 1 件 リアクション 0 件 担当者 1 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@cliffhall がすでに取り組んでいます。

2026年10月20日 から。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
35/100
issue の種類
機能追加
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
github-actions
領域
ci-cd, security

調査の方向性

Start with dependabot-alerts.yml and the sweep sections in AGENTS.md to identify the existing PROJECT_TOKEN usage and where the new secret names belong. Review the permissions table and the actions/create-github-app-token workflow step, then use a throwaway workflow_dispatch run to verify that the installed App can read the board. Done means the App is installed only on inspector, the listed org and repository permissions are exact, secrets are restricted to that repository, and the names are recorded in AGENTS.md.

索引モデルが issue の本文から書いたものです。

説明

chore v2

Problem

Three planned automations write to the org project board or read security alerts, and all are blocked on the same missing credential: GHSA draft cards (#2462), nightly triage (#2463), and the security sweep (#2542). dependabot-alerts.yml already reads secrets.PROJECT_TOKEN, but the secret does not exist, so the daily sweep files issues it cannot board.

The built-in GITHUB_TOKEN cannot hold organization projects: write, so the board write needs a separate identity. The App's spec currently lives inside #2462's body; this issue gives the prerequisite its own card.

What to create

A GitHub App installed on the modelcontextprotocol org, on the inspector repository only. It is only an identity with permissions: no code and no server. Workflows mint a short-lived installation token from it on each run with actions/create-github-app-token.

Scope Permission Needed by
Organization Projects: read & write every board write (#2462, #2463, #2542, the Dependabot sweep)
Repository Issues: read & write filing, labeling and commenting on issues
Repository Repository security advisories: read GHSA draft cards (#2462)
Repository Dependabot alerts: read the Dependabot sweep (#2542)
Repository Code scanning alerts: read the code-scanning sweep (#2542)
Repository Administration: read makes the sweep's automated-security-fixes check a real assertion instead of UNVERIFIED

Grant nothing beyond this list. In particular: no Contents write, no Workflows, no Secrets.

Storage

  • The App id and private key go in org Actions secrets limited to the inspector repo (for example INSPECTOR_BOT_APP_ID and INSPECTOR_BOT_PRIVATE_KEY).
  • Record the chosen secret names in AGENTS.md, next to the sweep sections that consume them.

Notes

  • This is an org-admin act and stays human-gated. An agent cannot create or install the App.
  • The fallback is a fine-grained PAT with the same permissions, stored as PROJECT_TOKEN. It is quicker to set up, but it is tied to one person and must be rotated by hand. The App is preferred.

Acceptance

  • App created and installed on inspector only, with exactly the permissions above
  • App id and private key stored as org Actions secrets limited to inspector
  • Secret names recorded in AGENTS.md
  • A throwaway workflow_dispatch run mints a token and reads the board, proving the install before the sweeps depend on it

Part of tracker #2543. Every board-writing sub-issue there is blocked on this one.

主要言語
TypeScript
スター
11.1k
フォーク
1.6k
平均マージ
4時間 56分
マージ済み PR（30日）
155

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

modelcontextprotocol/inspector のほかの issue

modelcontextprotocol/inspector の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。