From cbb40156decb69c9a10b010846e5b1f6ca33523d Mon Sep 17 00:00:00 2001
From: "Michael A. Smith" <michael@opencoreemr.com>
Date: Tue, 1 Sep 2026 17:28:56 -0400
Subject: [PATCH] ci(release-please): pass the Client ID as client-id, not the
 deprecated app-id

APP_CLIENT_ID holds a Client ID, so it belongs in
create-github-app-token's `client-id` input. `app-id` still accepts one,
but the action now warns on it at runtime, and because this workflow is
reusable that warning is emitted on every release across the org.

actionlint bundles a snapshot of each action's inputs and its copy of
create-github-app-token predates the rename, so it fails on `client-id`
and simultaneously demands the `app-id` it replaced. v1.7.12 is the
newest release and still carries the old set, so no linter bump resolves
this. Suppress those two messages in .github/actionlint.yaml instead;
the previous comment here said to wait for actionlint, but it has been a
year and the warning fires org-wide in the meantime.

Scoped to the two messages on this one file. php-tests.yml and
php-composer-script.yml keep `app-id` deliberately: their credential is a
caller-supplied `app-id` secret rather than a Client ID, and they stay
covered by the normal rules. Both scope limits verified against 1.7.12 by
injection: `client-id` in php-tests.yml still fails, and a private-key
typo inside the suppressed file still fails.

Callers are unaffected. The input rename carries the same credential to
the same action, so no repo needs to change how it calls this workflow.

Assisted-by: Claude Code
---
 .github/actionlint.yaml                       | 17 +++++++++++++++++
 .github/workflows/release-please-reusable.yml | 13 ++++++++-----
 2 files changed, 25 insertions(+), 5 deletions(-)
 create mode 100644 .github/actionlint.yaml

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000..010c8b1
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,17 @@
+# actionlint bundles a snapshot of each action's inputs. Its copy of
+# actions/create-github-app-token predates the app-id -> client-id rename, so
+# it rejects the current, non-deprecated input name. v1.7.12 is the newest
+# release and still has the old set, so there is no linter bump that resolves
+# this; the suppression below is the only way to call the action without
+# tripping its runtime deprecation warning.
+#
+# Deliberately scoped to these two messages on this one file. php-tests.yml and
+# php-composer-script.yml still pass `app-id` because their credential is a
+# caller-supplied `app-id` secret rather than a Client ID, and they stay
+# covered by the normal rules. Drop this file once actionlint ships the
+# renamed input.
+paths:
+  .github/workflows/release-please-reusable.yml:
+    ignore:
+      - 'missing input "app-id" which is required by action "actions/create-github-app-token'
+      - 'input "client-id" is not defined in action "actions/create-github-app-token'
diff --git a/.github/workflows/release-please-reusable.yml b/.github/workflows/release-please-reusable.yml
index dfac26a..2b659e1 100644
--- a/.github/workflows/release-please-reusable.yml
+++ b/.github/workflows/release-please-reusable.yml
@@ -131,11 +131,14 @@ jobs:
         if: ${{ env.APP_CLIENT_ID != '' && env.APP_PRIVATE_KEY != '' }}
         uses: actions/create-github-app-token@v3
         with:
-          # `app-id` accepts a Client ID as well; the action emits a runtime
-          # deprecation warning preferring `client-id`, but the bundled
-          # actionlint database doesn't know `client-id` yet and fails the
-          # workflow. Stay on `app-id` until actionlint catches up.
-          app-id: ${{ env.APP_CLIENT_ID }}
+          # The credential is a Client ID, so it belongs in `client-id`.
+          # `app-id` still accepts one but the action now warns on it at
+          # runtime, on every release across the org. actionlint's bundled
+          # action database predates the rename and rejects `client-id`, so
+          # `.github/actionlint.yaml` suppresses those two messages for this
+          # file alone. Drop that suppression when actionlint ships the new
+          # input set.
+          client-id: ${{ env.APP_CLIENT_ID }}
           private-key: ${{ env.APP_PRIVATE_KEY }}
 
       - name: Resolve effective token