From 987102a140e47b3b923120b4d913fe4d5dc29817 Mon Sep 17 00:00:00 2001 From: "Michael A. Smith" Date: Tue, 1 Sep 2026 17:36:17 -0400 Subject: [PATCH 1/2] fix: run actionlint from the OCE fork with corrected action metadata MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Upstream actionlint v1.7.12 ships stale bundled metadata for `actions/create-github-app-token@v3`: it still marks `app-id` as required and does not know `client-id`, so every call site using the canonical (non-deprecated) input gets two false positives. Upstream's metadata-refresh workflow has been wedged since 2026-03 and the fixes (rhysd/actionlint#652, #668) are unmerged. Points the lint step at openCoreEMR/actionlint@v1.7.12-oce.1 — v1.7.12 plus the regenerated metadata entry. No published image is needed; GitHub builds the action from the fork's Dockerfile exactly as it does for upstream. --- .github/workflows/actionlint.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml index 6d51e1e..7b6c579 100644 --- a/.github/workflows/actionlint.yml +++ b/.github/workflows/actionlint.yml @@ -50,4 +50,4 @@ jobs: uses: actions/checkout@v7 - name: Run actionlint - uses: rhysd/actionlint@v1.7.12 + uses: openCoreEMR/actionlint@v1.7.12-oce.1 From 5b6422aa33e34fec28265379e2466ebf05e08ece Mon Sep 17 00:00:00 2001 From: "Michael A. Smith" Date: Tue, 1 Sep 2026 17:42:20 -0400 Subject: [PATCH 2/2] fix: use the canonical client-id input for create-github-app-token With actionlint no longer suppressing it, three call sites surfaced as using the deprecated `app-id` input. All were already passing a Client ID, so this is a key rename with no behaviour change. release-please-reusable.yml also carried a comment saying to stay on `app-id` until actionlint caught up; the OCE fork does, so it is gone. The reusable-workflow secret keeps the name `app-id` to avoid breaking pinned callers; only its description and the value it feeds change. --- .github/actionlint.yaml | 17 ----------------- .github/workflows/php-composer-script.yml | 4 ++-- .github/workflows/php-tests.yml | 2 +- .github/workflows/release-please-reusable.yml | 7 ------- 4 files changed, 3 insertions(+), 27 deletions(-) delete mode 100644 .github/actionlint.yaml diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml deleted file mode 100644 index 010c8b1..0000000 --- a/.github/actionlint.yaml +++ /dev/null @@ -1,17 +0,0 @@ -# actionlint bundles a snapshot of each action's inputs. Its copy of -# actions/create-github-app-token predates the app-id -> client-id rename, so -# it rejects the current, non-deprecated input name. v1.7.12 is the newest -# release and still has the old set, so there is no linter bump that resolves -# this; the suppression below is the only way to call the action without -# tripping its runtime deprecation warning. -# -# Deliberately scoped to these two messages on this one file. php-tests.yml and -# php-composer-script.yml still pass `app-id` because their credential is a -# caller-supplied `app-id` secret rather than a Client ID, and they stay -# covered by the normal rules. Drop this file once actionlint ships the -# renamed input. -paths: - .github/workflows/release-please-reusable.yml: - ignore: - - 'missing input "app-id" which is required by action "actions/create-github-app-token' - - 'input "client-id" is not defined in action "actions/create-github-app-token' diff --git a/.github/workflows/php-composer-script.yml b/.github/workflows/php-composer-script.yml index cfb29b8..1ed6ab1 100644 --- a/.github/workflows/php-composer-script.yml +++ b/.github/workflows/php-composer-script.yml @@ -90,7 +90,7 @@ on: default: ubuntu-latest secrets: app-id: - description: GitHub App ID for private-repos auth + description: GitHub App Client ID for private-repos auth required: false app-private-key: description: GitHub App private key for private-repos auth @@ -111,7 +111,7 @@ jobs: id: app-token uses: actions/create-github-app-token@v3 with: - app-id: ${{ secrets.app-id }} + client-id: ${{ secrets.app-id }} private-key: ${{ secrets.app-private-key }} owner: ${{ github.repository_owner }} repositories: ${{ inputs.private-repos }} diff --git a/.github/workflows/php-tests.yml b/.github/workflows/php-tests.yml index 1dc48c9..371e8ef 100644 --- a/.github/workflows/php-tests.yml +++ b/.github/workflows/php-tests.yml @@ -111,7 +111,7 @@ jobs: id: app-token uses: actions/create-github-app-token@v3 with: - app-id: ${{ secrets.app-id }} + client-id: ${{ secrets.app-id }} private-key: ${{ secrets.app-private-key }} owner: ${{ github.repository_owner }} repositories: ${{ inputs.private-repos }} diff --git a/.github/workflows/release-please-reusable.yml b/.github/workflows/release-please-reusable.yml index 2b659e1..17aec33 100644 --- a/.github/workflows/release-please-reusable.yml +++ b/.github/workflows/release-please-reusable.yml @@ -131,13 +131,6 @@ jobs: if: ${{ env.APP_CLIENT_ID != '' && env.APP_PRIVATE_KEY != '' }} uses: actions/create-github-app-token@v3 with: - # The credential is a Client ID, so it belongs in `client-id`. - # `app-id` still accepts one but the action now warns on it at - # runtime, on every release across the org. actionlint's bundled - # action database predates the rename and rejects `client-id`, so - # `.github/actionlint.yaml` suppresses those two messages for this - # file alone. Drop that suppression when actionlint ships the new - # input set. client-id: ${{ env.APP_CLIENT_ID }} private-key: ${{ env.APP_PRIVATE_KEY }}