SRE-924: Sign the Renovate App JWT in Vault - #95

.github/actions/github-app-token/action.yml:60

• inputs.repository may be empty (and the input default cannot safely reference contexts). Use an expression fallback here so the action scopes to the current repo when callers don't provide repository.

        TRANSIT_KEY: ${{ inputs.transit-key }}
        APP_ID: ${{ inputs.app-id }}
        REPOSITORY: ${{ inputs.repository }}

.github/actions/github-app-token/token.sh:46

• Similarly, fail fast if the installation lookup or access token response doesn't contain the expected fields; otherwise jq -r can produce null and the script will continue with invalid values.

# Looked up rather than configured, so a new caller needs no extra input.
installation=$(github_api "https://api.github.com/repos/${REPOSITORY}/installation" | jq --raw-output '.id')
token=$(github_api --request POST \
    --data "$(jq --null-input --arg repo "${REPOSITORY#*/}" '{repositories: [$repo]}')" \
    "https://api.github.com/app/installations/${installation}/access_tokens" | jq --raw-output '.token')

.github/workflows/housekeeping-dependencies.yml:77

• This secret is declared optional, but the workflow always passes it into the github-app-token action, whose script hard-requires CF_ACCESS_CLIENT_SECRET. Callers that have not been updated to pass this secret will still be able to dispatch the workflow (because required: false) but will then fail at runtime. If this workflow cannot function without it, it should be marked required so callers fail at dispatch time as intended.

  contents: read

.github/actions/github-app-token/token.sh:17

• The App JWT payload encodes iss as a JSON string ("iss":"${APP_ID}"). GitHub App JWTs expect iss to be the numeric App ID, and string-encoding can cause authentication failures when exchanging for an installation token.

header=$(printf '%s' '{"alg":"RS256","typ":"JWT"}' | base64url)
payload=$(printf '{"iss":"%s","iat":%d,"exp":%d}' "${APP_ID}" "$((now - 60))" "$((now + 540))" | base64url)
signing_input="${header}.${payload}"

.github/actions/github-app-token/token.sh:28

• The Vault transit API request body is JSON, but the curl call doesn’t set a JSON Content-Type. Setting it explicitly avoids relying on server-side content sniffing and prevents regressions if Vault becomes stricter about request headers.

signature=$(curl --silent --show-error --fail-with-body --request POST \
    --header "X-Vault-Token: ${VAULT_TOKEN}" \
    --header "CF-Access-Client-Id: ${CF_ACCESS_CLIENT_ID}" \
    --header "CF-Access-Client-Secret: ${CF_ACCESS_CLIENT_SECRET}" \
    --data "${request}" \

.github/actions/github-app-token/token.sh:48

• This GitHub API call sends a JSON body via --data, but no Content-Type: application/json header is set. Adding it makes the request unambiguous and avoids relying on GitHub accepting JSON with curl’s default form content type.

token=$(github_api --request POST \
    --data "$(jq --null-input --arg repo "${REPOSITORY#*/}" '{repositories: [$repo]}')" \
    "https://api.github.com/app/installations/${installation}/access_tokens" | jq --exit-status --raw-output '.token')

.github/workflows/preflight-pr-title.yml:10

• The exemption list in the workflow if: includes hash-dependencies[bot] and hash-release[bot], but this comment doesn’t name them, making it unclear which accounts are exempt (and why). Consider naming the exact logins to keep the documentation accurate and easy to audit.

# Exempt are `dependabot[bot]`, the account that opens renovate PRs, and the one
# changesets opens the release PR as. Any other account — including other bots
# and GitHub Apps such as Claude — must reference a Linear issue ID.

.github/actions/github-app-token/token.sh:49

• This POST to the GitHub REST API sends a JSON body, but no Content-Type: application/json header is set. curl --data defaults to application/x-www-form-urlencoded, which can cause the API to reject the payload as invalid JSON.

token=$(github_api --request POST \
    --data "$(jq --null-input --arg repo "${REPOSITORY#*/}" '{repositories: [$repo]}')" \
    "https://api.github.com/app/installations/${installation}/access_tokens" | jq --exit-status --raw-output '.token')