From 7a8c342da2c28aa10fac9e19255eae22f2251f7d Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 22 Jul 2026 20:21:27 +0000 Subject: [PATCH 1/3] Use per-category GitHub App token for data generation Generate a short-lived GitHub App installation token in each category-data matrix job via actions/create-github-app-token instead of sharing the static DATA_GENERATOR_TOKEN secret. Because the job is a matrix (one runner per category), each category now mints its own token and gets its own GitHub API rate-limit budget. The token feeds the existing DATA_GENERATOR_TOKEN env var, so no changes to the generator script are required. Requires new secrets DATA_GENERATOR_APP_ID and DATA_GENERATOR_APP_PEM. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01SwnRB6MUSuVd412MHEMpA9 --- .github/workflows/generate-hacs-data.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/generate-hacs-data.yml b/.github/workflows/generate-hacs-data.yml index 89887e1a73c..7d623f13ee5 100644 --- a/.github/workflows/generate-hacs-data.yml +++ b/.github/workflows/generate-hacs-data.yml @@ -77,10 +77,17 @@ jobs: scripts/install/frontend scripts/install/pip_packages --requirement requirements_generate_data.txt + - name: Generate app token + id: token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + app-id: ${{ secrets.DATA_GENERATOR_APP_ID }} + private-key: ${{ secrets.DATA_GENERATOR_APP_PEM }} + - name: Generate ${{ matrix.category }} data run: python3 -m scripts.data.generate_category_data ${{ matrix.category }} env: - DATA_GENERATOR_TOKEN: ${{ secrets.DATA_GENERATOR_TOKEN }} + DATA_GENERATOR_TOKEN: ${{ steps.token.outputs.token }} FORCE_REPOSITORY_UPDATE: ${{ inputs.forceRepositoryUpdate }} - name: Validate output with JQ From e91711b3f5522696daca8bda63bbf4ab4a05a2a5 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 22 Jul 2026 20:24:39 +0000 Subject: [PATCH 2/3] Use client-id input for app token generation client-id is the recommended input over the legacy app-id. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01SwnRB6MUSuVd412MHEMpA9 --- .github/workflows/generate-hacs-data.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/generate-hacs-data.yml b/.github/workflows/generate-hacs-data.yml index 7d623f13ee5..b5df425f5a5 100644 --- a/.github/workflows/generate-hacs-data.yml +++ b/.github/workflows/generate-hacs-data.yml @@ -81,7 +81,7 @@ jobs: id: token uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: - app-id: ${{ secrets.DATA_GENERATOR_APP_ID }} + client-id: ${{ secrets.DATA_GENERATOR_APP_ID }} private-key: ${{ secrets.DATA_GENERATOR_APP_PEM }} - name: Generate ${{ matrix.category }} data From e650128cd5f772ae1976e9c48e9034552bc6966b Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 22 Jul 2026 20:25:42 +0000 Subject: [PATCH 3/3] Rename secret to DATA_GENERATOR_APP_CLIENT_ID Reflects that the secret holds the GitHub App Client ID. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01SwnRB6MUSuVd412MHEMpA9 --- .github/workflows/generate-hacs-data.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/generate-hacs-data.yml b/.github/workflows/generate-hacs-data.yml index b5df425f5a5..7d904199daa 100644 --- a/.github/workflows/generate-hacs-data.yml +++ b/.github/workflows/generate-hacs-data.yml @@ -81,7 +81,7 @@ jobs: id: token uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: - client-id: ${{ secrets.DATA_GENERATOR_APP_ID }} + client-id: ${{ secrets.DATA_GENERATOR_APP_CLIENT_ID }} private-key: ${{ secrets.DATA_GENERATOR_APP_PEM }} - name: Generate ${{ matrix.category }} data