Fix pat-cross-repo in publish--push-charts.yml

[CodeOpsAI]

🤖 An AI-generated pull request from codeopsai. We open PRs only when we find a concrete, citable issue worth fixing. Not useful? Comment "no thanks" and we won't open more.

About codeopsai

codeopsai analyzes public GitHub Actions workflows for security and reliability issues and opens fixes for maintainer review. Every PR carries citations to the relevant standard (CWE, GitHub docs) and a structural verification trail; if our evidence bar isn't met, we don't open the PR.

Mistake, or unwelcome? Comment here or open an issue at github.com/codeopsai/feedback. We read every one and adjust.

⚠️ Advisory PR — maintainer setup required before merge.

This PR inserts a GitHub App installation token step that references vars.APP_ID and secrets.APP_PRIVATE_KEY — neither exists yet on this repo. Complete the checklist below first, then mark the PR ready-for-review.

Setup checklist

• Register a GitHub App with the permissions listed in the inserted step's permission-<name> inputs, and install it on the target repository.
• Store the App's Client ID in repository or organization variables as APP_ID.
• Store the App's private key in repository or organization secrets as APP_PRIVATE_KEY.

Once these three are done, mark this PR ready-for-review and merge. The actions/create-github-app-token step will generate a short-lived, repo-scoped token at runtime — strictly safer than the long-lived PAT it replaces.

Why these matter

Why downgrade these tokens (pat-cross-repo)

Each Personal Access Token below is used for a read-only operation against a public repository. A PAT carries the union of its owner's repository permissions — almost always broader than these reads require. GITHUB_TOKEN is workflow-scoped, ephemeral, and provides the same 5000/hr authenticated rate limit for public read operations — the strictly-safer credential. The tj-actions/changed-files supply-chain attack (CVE-2025-30066, Mar 2025) explicitly enumerated PATs among the secrets it exfiltrated.

Reference: CWE-1392 · GitHub/OWASP guidance · Real-world precedent: tj-actions/changed-files supply-chain attack (CVE-2025-30066, Mar 2025) — exfiltrated PATs

.github/workflows/publish--push-charts.yml

• 🔴 HIGH pat-cross-repo (job push_charts)
• 🔴 HIGH pat-cross-repo (job push_charts)

Diff

--- a/.github/workflows/publish--push-charts.yml
+++ b/.github/workflows/publish--push-charts.yml
@@ -18,11 +18,20 @@
         id: vars
         run: echo tag=$(echo ${GITHUB_REF:11}) >> $GITHUB_OUTPUT
 
+      - uses: actions/create-github-app-token@v3
+        id: app-token
+        with:
+          app-id: ${{ vars.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: |
+            stunner-helm
+          permission-actions: write
       - name: Trigger release workflow in the stunner-helm repo
         if: ${{ inputs.dev == false || inputs.dev == 'false' }}
         uses: benc-uk/workflow-dispatch@v1
         with:
-          token: ${{ secrets.WEB_PAT_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
           repo: l7mp/stunner-helm
           workflow: publish.yaml
           inputs: '{"tag": "${{ steps.vars.outputs.tag }}", "type": "stunner"}'

---

Have other repositories you'd like analysed? Request a scan at codeopsai.com.

---

AI-generated. Review the diff before merging.