Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: actions/create-github-app-token
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v3.1.0
Choose a base ref
...
head repository: actions/create-github-app-token
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v3.1.1
Choose a head ref
  • 3 commits
  • 6 files changed
  • 4 contributors

Commits on Apr 11, 2026

  1. ci: remove publish-immutable-action workflow (#361) 

    The `publish-immutable-action` workflow uses `actions/publish-immutable-action@v0.0.4`. The Immutable Actions Publishing feature (OCI-based) has been paused with no GA timeline. This removes the workflow; it can be re-added when the feature becomes generally available.

To fully address #352, the repository-level **immutable releases** setting has also be enabled. This [feature](https://github.blog/changelog/2025-10-28-immutable-releases-are-now-generally-available/) locks release tags and assets after publication, directly preventing the class of attack described in [GHSA-mrrh-fwg8-r2c3](GHSA-mrrh-fwg8-r2c3).

The existing release workflow is compatible with immutable releases. Build artifacts are committed via `@semantic-release/git` before the tag is created, and major version tags (`v3`, etc.) are plain git tags (not releases) so they remain updatable.
    @parkerbxyz
    parkerbxyz authored Apr 11, 2026
    Configuration menu
    Copy the full SHA
    ea01216 View commit details
    Browse the repository at this point in the history

  2. fix: improve error message when app identifier is empty (#362) 

    When `client-id` (or the deprecated `app-id`) resolves to an empty
string, for example because a secret or variable is not available in the
workflow context, the error message from `@octokit/auth-app` is not very
helpful:

```
[@octokit/auth-app] appId option is required
```

A validation check was added recently to catch this earlier, but its
message could be more informative:

```
Either 'client-id' or 'app-id' input must be set
```

This updates the message to clarify that the value resolved to empty and
nudges users toward checking their secret or variable availability:

```
The 'client-id' input must be set to a non-empty string. If using a secret or variable, ensure it is available in this workflow context.
```

Closes #249

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
    @parkerbxyz
    3 people authored Apr 11, 2026
    Configuration menu
    Copy the full SHA
    07e2b76 View commit details
    Browse the repository at this point in the history

  3. build(release): 3.1.1 [skip ci] 

    ## [3.1.1](v3.1.0...v3.1.1) (2026-04-11)

### Bug Fixes

* improve error message when app identifier is empty ([#362](#362)) ([07e2b76](07e2b76)), closes [#249](#249)
    @semantic-release-bot
    semantic-release-bot committed Apr 11, 2026
    Configuration menu
    Copy the full SHA
    1b10c78 View commit details
    Browse the repository at this point in the history
Loading