fix(ci): use version-bot GitHub App to bypass platform ruleset on submodule bump

[hermes-exosphere]

Problem

The bump-platform-submodule workflow pushes submodule pointer bumps directly to FailproofAI/platform main. Since the platform repo is now governed by the failproofai-rules ruleset (PR + 1 review required), direct pushes are rejected with:

remote: error: GH013: Repository rule violations found for refs/heads/main.
remote: - Changes must be made through a pull request.

Solution

Modeled after the agenteye release-agent.yml advance job — mint a version-bot GitHub App token and push with it. The version-bot App is a bypass actor on the failproofai-rules ruleset, so its pushes to main are accepted.

Changes

1. New step: Mint version-bot app token using actions/create-github-app-token@v2 with VERSION_BOT_APP_ID / VERSION_BOT_PRIVATE_KEY secrets
2. Checkout: persists the app token so subsequent git push commands inherit bypass credentials (no more persist-credentials: false)
3. Simplified push: removed the manual http.extraheader auth plumbing — the app token from checkout handles it
4. Bot identity: agenteye-bot instead of github-actions[bot] (consistent with agenteye's convention)

Pre-merge checklist

• VERSION_BOT_APP_ID and VERSION_BOT_PRIVATE_KEY secrets exist in the FailproofAI/failproofai repo
• The version-bot GitHub App is installed on FailproofAI/platform with contents: write permission
• The version-bot App is a bypass actor on the failproofai-rules ruleset in the platform repo

Summary by CodeRabbit

• Chores
  • Improved automated platform updates with more reliable authentication.
  • Updated the automation’s commit identity.
  • Improved retry handling for failed update pushes.

[coderabbitai]

📝 Walkthrough

Walkthrough

The platform submodule bump workflow now mints a version-bot GitHub App token, uses it during checkout, changes the git author, and performs plain push and fetch commands in its retry loop.

Changes

Platform submodule bump authentication

Layer / File(s)	Summary
Token and checkout setup .github/workflows/bump-platform-submodule.yml	The workflow documents the ruleset behavior, mints a version-bot app token, uses it for checkout, disables submodule fetching, and sets agenteye-bot as the git author.
Push and retry authentication .github/workflows/bump-platform-submodule.yml	The retry loop replaces header-authenticated push and fetch commands with plain git push origin main and git fetch origin main.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• FailproofAI/failproofai#394: Modifies the same workflow’s authentication, checkout, and retry push flow.
• FailproofAI/failproofai#395: Addresses Git-over-HTTPS authentication headers in the same workflow.

Suggested reviewers: niveditjain

Poem

A rabbit hops where tokens run,
An app-bot blooms beneath the sun.
The submodule bounds ahead,
With agenteye-bot in thread,
And pushes safely when it’s done.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main CI change: using a version-bot GitHub App to bypass the platform ruleset.
Description check	✅ Passed	The description covers the problem, solution, change details, and a pre-merge checklist, though it doesn't follow the template's exact sections.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hermes-exosphere]

🔍 Automated code review started — analyzing [{"additions":22,"deletions":17,"path":".github/workflows/bump-platform-submodule.yml"}] files, +22/-17...

⏱️ This may take a few minutes. Results will be posted here when complete.

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/bump-platform-submodule.yml (1)

31-34: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Apply least-privilege scoping to the GitHub App token.

By default, the minted token inherits the blanket permissions and repository access of the App installation. To improve security, restrict the token to only the target repository.

🔒️ Proposed fix to restrict token scope

       - name: Mint version-bot app token
         id: app-token
         uses: actions/create-github-app-token@v2
         with:
           app-id: ${{ secrets.VERSION_BOT_APP_ID }}
           private-key: ${{ secrets.VERSION_BOT_PRIVATE_KEY }}
+          owner: FailproofAI
+          repositories: platform

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/bump-platform-submodule.yml around lines 31 - 34, Update
the create-github-app-token step to restrict the minted token to the target
repository using the action’s repository-scoping input, while preserving the
existing VERSION_BOT_APP_ID and VERSION_BOT_PRIVATE_KEY credentials.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/bump-platform-submodule.yml:
- Around line 31-34: Update the create-github-app-token step to restrict the
minted token to the target repository using the action’s repository-scoping
input, while preserving the existing VERSION_BOT_APP_ID and
VERSION_BOT_PRIVATE_KEY credentials.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 72de39a1-79a0-426e-b5c9-12938584bc48

📥 Commits

Reviewing files that changed from the base of the PR and between f126cfd and 832f277.

📒 Files selected for processing (1)

• .github/workflows/bump-platform-submodule.yml

[hermes-exosphere]

🔍 Automated Code Review

📋 Executive Summary

This PR migrates bump-platform-submodule.yml from a fine-grained PAT (PLATFORM_BUMP_TOKEN) to a version-bot GitHub App token so pushes to FailproofAI/platform main bypass the new failproofai-rules ruleset. The intent and structure are sound and the diff is clean, but the token is never scoped to the platform repo, so as written the workflow will fail before it can push. One blocking fix is required; two smaller items are worth addressing.

---

📊 Change Architecture

graph TD
    A["push to failproofai/main"] --> B["Mint version-bot app token<br/>(NEW step)"]
    B -->|"token scoped to CURRENT repo only<br/>❌ missing owner/repositories"| C["Checkout FailproofAI/platform<br/>token = app-token<br/>persist-credentials (default)"]
    C -->|"persisted creds → git push"| D["Bump gitlink + race-safe push loop"]
    D --> E["FailproofAI/platform main"]
    R["failproofai-rules ruleset<br/>(PR + 1 review)"] -.->|"bypass actor = version-bot App"| E
    style B fill:#90EE90
    style C fill:#87CEEB
    style D fill:#87CEEB
    style B stroke:#d00,stroke-width:3px

Loading

Legend: 🟢 New | 🔵 Modified | 🔴 outline = blocking defect

---

🔴 Breaking Changes

• The workflow stops working until the token is scoped correctly. create-github-app-token with no owner/repositories yields a token for FailproofAI/failproofai only; every step here targets FailproofAI/platform. This is the single blocking issue (details inline).
• Removes all use of the PLATFORM_BUMP_TOKEN secret. Once this is merged and working, that secret is orphaned and can be deleted — but do not delete it until the app-token path is verified green, since it is the current working mechanism.

---

⚠️ Issues Found

1. 🔴 Critical — .github/workflows/bump-platform-submodule.yml:29-34 — App token minted without owner/repositories; scoped to the current repo, cannot check out or push to FailproofAI/platform. Workflow fails at token-mint or checkout. (verified against official create-github-app-token docs)
2. 🟡 Warning — .github/workflows/bump-platform-submodule.yml:37 — actions/checkout un-pinned from a full commit SHA to floating @v7; supply-chain regression and looser than the rest of the repo. New create-github-app-token@v2 is also floating-major.
3. 🔵 Info — .github/workflows/bump-platform-submodule.yml:56-57 — Commit identity is agenteye-bot while the App is named version-bot; and agenteye-bot@users.noreply.github.com is not a real linked no-reply address, so bump commits will show an unlinked author. Cosmetic (ruleset bypass keys off the token’s App actor, not the git author), but confusing.
4. 🔵 Info — Repo policy: CLAUDE.md requires every PR to update CHANGELOG.md. This PR does not, and the existing ci: auto-bump platform submodule on merge to main #394 entry still describes PLATFORM_BUMP_TOKEN as the mechanism (now stale).

---

🔬 Logical / Bug Analysis

• Token scoping (blocking): confirmed via the action’s documentation — “If owner and repositories are empty, access will be scoped to only the current repository.” Cross-repo access requires owner: FailproofAI + repositories: platform.
• Credential flow (correct): dropping persist-credentials: false and the manual http.extraheader plumbing is the right simplification — checkout now persists the app token into git config, so the plain git push / git fetch origin main in the retry loop inherit it. This part is consistent and works once the token is correctly scoped.
• Race-safe loop (unchanged, fine): the 3-attempt fetch/rebase/push loop and the terminal ::error:: + exit 1 are preserved. Token expiry (~1h) is a non-issue at this runtime.
• Ruleset bypass (correct in principle): bypass is evaluated on the pushing App actor, not on user.name/user.email, so the identity rename does not affect the bypass.

---

🧪 Evidence — Build & Test Results

Validation performed

# YAML parses cleanly
YAML parses OK; top-level keys: [name, on, concurrency, jobs]
steps: [Mint version-bot app token, Checkout FailproofAI/platform main, Bump failproofai/oss gitlink and push]

# Programmatic check of the app-token step inputs
app-token step inputs: [app-id, private-key]
has owner: False | has repositories: False   <-- root cause of finding #1

# Official docs (actions/create-github-app-token):
"If owner and repositories are empty, access will be scoped to only the current repository."

# Repo pin convention (grep of .github/workflows):
ci.yml / publish.yml / translate-docs.yml : actions/checkout@v7.0.0
build-image.yml / osv-scanner.yml         : actions/checkout@<full-sha> # v7.0.0
this PR                                    : actions/checkout@v7   (looser)

No app build/test suite applies to a workflow-only change; the repo CI jobs (quality/test/build/test-e2e) do not exercise this workflow, and no actionlint runs in CI (an actionlint step would not have caught this semantic issue anyway).

---

🔗 Issue Linkage

⚠️ No issue linked via closingIssuesReferences. The PR body references CI failure GH013 and run 27208748580; consider linking a tracking issue for traceability.

---

👥 Human Review Feedback

No human review feedback on this PR. The only other comments are automated (coderabbitai[bot] — its review was still "in progress" at review time). No review threads exist yet, so nothing to resolve.

---

💡 Suggestions

• After scoping the token, tighten the pre-merge checklist to state the App must be installed on the org/owner with access to platform (not merely "installed on platform") and hold contents: write.
• Add a CHANGELOG.md entry under the current version documenting the PAT→App migration, and refresh the stale ci: auto-bump platform submodule on merge to main #394 wording.
• Consider permissions: {} (or contents: read) at job level so the default GITHUB_TOKEN is minimal — auth now comes entirely from the App token.

---

🏆 Verdict

🔴 CHANGES REQUESTED — 1 blocking issue: the minted App token is not scoped to FailproofAI/platform (missing owner/repositories), so the workflow cannot push and the PR does not achieve its goal. Add the scoping inputs, then this is close to mergeable. Warnings #2–#4 are non-blocking but recommended.

---

Automated code review · 2026-07-14 UTC