Skip to content

ci: Add GitHub App authentication support to review action #8368

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
bdougie wants to merge 14 commits into from
Closed

ci: Add GitHub App authentication support to review action #8368

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
135f762
Add GitHub App authentication support to review action
bdougie Oct 21, 2025
70e756f
Update create-github-app-token action to v2
bdougie Oct 21, 2025
9bc8000
Use pinned SHA for create-github-app-token and update workflow
bdougie Oct 21, 2025
d146aea
fix: remove duplicate app-id and private-key inputs from general-revi…
bdougie Oct 21, 2025
7000ec5
refactor: use explicit github-token input instead of internal app tok…
bdougie Oct 21, 2025
926349f
fix: make github-token optional for backward compatibility
bdougie Oct 22, 2025
41c4185
fix: correct if condition syntax in workflow files
bdougie Oct 23, 2025
9f53c16
fix: use CONTINUE_ prefix for App credentials in debug workflow
bdougie Oct 23, 2025
c2961c3
fix: remove ${{ }} wrapper from if conditions in workflows
bdougie Oct 23, 2025
77b4c8c
fix: correct step property order in workflow files
bdougie Oct 23, 2025
1a77ffa
feat: add synchronize trigger to continue-general-review workflow
bdougie Oct 23, 2025
99ed499
fix: remove push trigger from continue-general-review workflow
bdougie Oct 23, 2025
517323f
fix: simplify workflow to use default github.token
bdougie Oct 23, 2025
ef43cf5
fix: use vars.CONTINUE_APP_ID instead of secrets for App ID
bdougie Oct 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions .github/workflows/continue-general-review.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,9 +20,17 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- name: Generate GitHub App Token
Copy link
Copy Markdown
Contributor

@cubic-dev-ai cubic-dev-ai Bot Oct 21, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This step needs an if condition so it only runs when both app credentials are present; otherwise the action fails instead of falling back to the default GITHUB_TOKEN.

Prompt for AI agents 
Address the following comment on .github/workflows/continue-general-review.yaml at line 23:

<comment>This step needs an if condition so it only runs when both app credentials are present; otherwise the action fails instead of falling back to the default GITHUB_TOKEN.</comment>

<file context>
@@ -20,6 +20,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
+      - name: Generate GitHub App Token
+        id: generate-token
+        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v2.0.0
</file context>

✅ Addressed in 926349f

Copy link
Copy Markdown
Contributor

@cubic-dev-ai cubic-dev-ai Bot Oct 21, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This step always invokes create-github-app-token with required inputs, so runs without App credentials now fail instead of falling back to the default GITHUB_TOKEN. Please make the step conditional (and keep the original token path) so workflows without secrets still succeed.

Prompt for AI agents 
Address the following comment on .github/workflows/continue-general-review.yaml at line 23:

<comment>This step always invokes create-github-app-token with required inputs, so runs without App credentials now fail instead of falling back to the default GITHUB_TOKEN. Please make the step conditional (and keep the original token path) so workflows without secrets still succeed.</comment>

<file context>
@@ -20,9 +20,17 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
+      - name: Generate GitHub App Token
+        id: generate-token
+        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v2.0.0
</file context>

✅ Addressed in 926349f

id: generate-token
uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v2.0.0
with:
app-id: ${{ secrets.CONTINUE_APP_ID }}
Copy link
Copy Markdown
Contributor

@cubic-dev-ai cubic-dev-ai Bot Oct 23, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please source the app ID from `vars.CONTINUE_APP_ID`; using the secrets context leaves this input blank here, so the generated token step fails to authenticate the app. (Based on your team's feedback about sourcing APP_ID from GitHub Actions variables instead of secrets.)

View Feedback

Prompt for AI agents ~~~ Address the following comment on .github/workflows/continue-general-review.yaml at line 28: Please source the app ID from `vars.CONTINUE_APP_ID`; using the secrets context leaves this input blank here, so the generated token step fails to authenticate the app. (Based on your team's feedback about sourcing APP_ID from GitHub Actions variables instead of secrets.) @@ -20,9 +20,18 @@ jobs: + uses: actions/create-github-app-token@5d869da # v2.0.0 + if: secrets.CONTINUE_APP_ID != '' && secrets.CONTINUE_APP_PRIVATE_KEY != '' + with: + app-id: ${{ secrets.CONTINUE_APP_ID }} + private-key: ${{ secrets.CONTINUE_APP_PRIVATE_KEY }} + ~~~
```suggestion app-id: ${{ vars.CONTINUE_APP_ID }} ``` Fix with Cubic

Comment thread
bdougie marked this conversation as resolved.
Outdated
private-key: ${{ secrets.CONTINUE_APP_PRIVATE_KEY }}

- name: Run Continue PR Review Action
uses: continuedev/continue/actions/general-review@main
with:
continue-api-key: ${{ secrets.CONTINUE_API_KEY }}
continue-org: "continuedev"
continue-agent: "empty-agent"
github-token: ${{ steps.generate-token.outputs.token }}
10 changes: 8 additions & 2 deletions actions/general-review/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,9 @@ inputs:
continue-agent:
description: 'Agent path to use (e.g., "myorg/review-bot")'
required: true
github-token:
description: "GitHub token for API access"
required: true
Copy link
Copy Markdown
Contributor

@cubic-dev-ai cubic-dev-ai Bot Oct 21, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Requiring the new github-token input breaks existing workflows that call this action without it. Keep the input optional and explicitly fall back to github.token so current users remain compatible.

Prompt for AI agents 
Address the following comment on actions/general-review/action.yml at line 17:

<comment>Requiring the new github-token input breaks existing workflows that call this action without it. Keep the input optional and explicitly fall back to github.token so current users remain compatible.</comment>

<file context>
@@ -12,6 +12,9 @@ inputs:
     required: true
+  github-token:
+    description: &quot;GitHub token for API access&quot;
+    required: true
 
 runs:
</file context>

✅ Addressed in 926349f


runs:
using: "composite"
Expand All @@ -23,6 +26,7 @@ runs:
id: auth-check
uses: actions/github-script@v7
with:
github-token: ${{ inputs.github-token }}
script: |
let shouldRun = false;
let skipReason = '';
Expand Down Expand Up @@ -120,6 +124,7 @@ runs:
id: initial-comment
uses: actions/github-script@v7
with:
github-token: ${{ inputs.github-token }}
script: |
const marker = '<!-- continue-agent-review -->';

Expand Down Expand Up @@ -205,7 +210,7 @@ runs:
if: env.SHOULD_RUN == 'true'
shell: bash
env:
GITHUB_TOKEN: ${{ github.token }}
GITHUB_TOKEN: ${{ inputs.github-token }}
run: |
# Get PR number based on event type
if [ "${{ github.event_name }}" = "pull_request" ]; then
Expand All @@ -228,7 +233,7 @@ runs:
CONTINUE_API_KEY: ${{ inputs.continue-api-key }}
CONTINUE_ORG: ${{ inputs.continue-org }}
CONTINUE_AGENT: ${{ inputs.continue-agent }}
GITHUB_TOKEN: ${{ github.token }}
GITHUB_TOKEN: ${{ inputs.github-token }}
run: |
echo "Running Continue CLI with prompt:"
echo "=================================="
Expand Down Expand Up @@ -339,6 +344,7 @@ runs:
if: env.SHOULD_RUN == 'true' && always()
uses: actions/github-script@v7
with:
github-token: ${{ inputs.github-token }}
script: |
const fs = require('fs');

Expand Down
Loading