c7e4ddfb59
An App private key is not scoped: it can mint tokens for every repo its App is installed on, with the App's full entitlement. The owner and repositories inputs are step arguments, not a boundary. cloud-code-bot is entitled to cloud's production release and migration workflows, so storing its key in this public repo would join the two repos' trust boundaries at the weaker one. Use a single-purpose App holding only contents:write on Comfy-Org/cloud instead -- the same minimal scope the outgoing PAT had, without the silent expiry. |
||
|---|---|---|
| .. | ||
| ISSUE_TEMPLATE | ||
| PULL_REQUEST_TEMPLATE | ||
| scripts | ||
| workflows | ||