ci: migrate workflows to gh-sts for scoped GitHub tokens#2005
Open
TooTallNate wants to merge 4 commits into
Open
ci: migrate workflows to gh-sts for scoped GitHub tokens#2005TooTallNate wants to merge 4 commits into
TooTallNate wants to merge 4 commits into
Conversation
Contributor
|
Contributor
🧪 E2E Test Results❌ Some tests failed Summary
❌ Failed Tests▲ Vercel Production (4 failed)nextjs-turbopack (2 failed):
nitro (1 failed):
vite (1 failed):
Details by Category❌ ▲ Vercel Production
✅ 💻 Local Development
✅ 📦 Local Production
✅ 🐘 Local Postgres
✅ 🪟 Windows
✅ 📋 Other
❌ Some E2E test jobs failed:
Check the workflow run for details. |
Contributor
📊 Benchmark Results
workflow with no steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) | Nitro workflow with 1 step💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Next.js (Turbopack) workflow with 10 sequential steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Next.js (Turbopack) workflow with 25 sequential steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Next.js (Turbopack) workflow with 50 sequential steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) | Nitro Promise.all with 10 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) | Nitro Promise.all with 25 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Next.js (Turbopack) Promise.all with 50 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) | Nitro Promise.race with 10 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) | Nitro Promise.race with 25 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) | Nitro Promise.race with 50 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) | Nitro workflow with 10 sequential data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) | Nitro workflow with 25 sequential data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) | Nitro workflow with 50 sequential data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) | Nitro workflow with 10 concurrent data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) | Nitro workflow with 25 concurrent data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) | Nitro workflow with 50 concurrent data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Next.js (Turbopack) Stream Benchmarks (includes TTFB metrics)workflow with stream💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Next.js (Turbopack) stream pipeline with 5 transform steps (1MB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) | Nitro 10 parallel streams (1MB each)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Next.js (Turbopack) fan-out fan-in 10 streams (1MB each)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) SummaryFastest Framework by WorldWinner determined by most benchmark wins
Fastest World by FrameworkWinner determined by most benchmark wins
Column Definitions
Worlds:
❌ Some benchmark jobs failed:
Check the workflow run for details. |
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the backport-to-stable GitHub Actions workflow to mint a scoped GitHub App installation token via vercel/gh-sts-action, addressing org policy restrictions that prevent the default GITHUB_TOKEN from calling createCommitOnBranch (needed to produce GitHub-signed commits for protected branches).
Changes:
- Add
id-token: writeto allow exchanging the job’s OIDC token for a scoped GitHub App token via gh-sts. - Use the gh-sts minted token for the
createCommitOnBranchpush step and for creating the backport PR, while keeping PR comment steps on the defaultGITHUB_TOKEN.
Comments suppressed due to low confidence (1)
.github/workflows/backport.yml:624
- The gh-sts minted token is only used here for
createCommitOnBranch(contents write) andgh pr create(pull_requests write). It doesn’t appear to be used for issue comments, so granting"issues":"write"is unnecessary. Consider dropping the issues permission from the gh-sts request to keep the installation token least-privileged.
with:
repos: vercel/workflow
permissions: '{"contents":"write","issues":"write","pull_requests":"write"}'
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
The default `GITHUB_TOKEN` recently lost the ability to call the `createCommitOnBranch` GraphQL mutation under our org's GHA token policy (returns "Resource not accessible by integration" / FORBIDDEN). That mutation is how we push a GitHub-signed commit to the backport branch — required by the enterprise "require signed branch commits" ruleset that targets ~ALL refs with no bypass actors. Switch to vercel/gh-sts-action to exchange the workflow's OIDC token for a scoped GitHub App installation token (via the new `vercel-workflow-backport-to-stable` gh-sts policy). Use that token for both the createCommitOnBranch push and the PR creation; leave the comment-on-PR steps on the default GITHUB_TOKEN since posting issue comments still works with it. Failing run that motivated this: https://github.com/vercel/workflow/actions/runs/25893078275
TooTallNate
force-pushed
the
ci/use-gh-sts-for-backport
branch
from
e186d09 to
531644c
Compare
The default GITHUB_TOKEN in these workflows is only used for read-only lookups (gh api, gh pr list, actions/checkout) and for posting issue comments back on the source PR; everything that writes to the repo goes through the scoped gh-sts token. Trim the job-level permissions to reflect that: - backport.yml: contents/pull-requests downgraded from write to read; drop unused issues:write from the gh-sts request (we only post comments via the default token). - release.yml: contents downgraded from write to read; drop unused pull-requests permission entirely. - tests.yml + benchmarks.yml (publish-results job): contents downgraded from write to read (only used for checkout).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrates the four CI workflows that need write access beyond what the default
GITHUB_TOKENnow allows to use gh-sts, which mints a scoped GitHub App installation token from the workflow's OIDC identity.backport.ymlcreateCommitOnBranchfor the backport branch —GITHUB_TOKENreturnsFORBIDDENunder the org's new GHA token policy. Visibly failing.release.ymlchangesets/actionusescommitMode: github-api(createCommitOnBranch) to update the "Version Packages" PR. Same root cause; will start failing on the next release.tests.ymlPublish E2E Resultsjob pushes JSON togh-pages. Has been silently failing on everymainpush since 2026-04-22 (enterprise "require signed commits on~ALLrefs" ruleset rejects unsigned pushes). Swappedpeaceiris/actions-gh-pagesfor an inlinecreateCommitOnBranchcall.benchmarks.ymlPublish Benchmark Results.Verification
backport.yml: re-running the failed PR #1828 backport viaworkflow_dispatchonce the companion infra PR is merged will exercise the new path.release.yml: next "Version Packages" update onmainwill exercise it.tests.yml/benchmarks.yml: confirmedgh-pagesis currently stuck at the 2026-04-22 commit; first push tomainafter merge will validate.