Repository navigation
ci(gh_app_token): --reads-only treats file-backed GraphQL requests as writes - #35824
Conversation
…le or stdin as a write A query given with `-F query=@file` or `--input` is not on the command line, so the wrapper cannot tell a mutation from a read; it now goes out once as github.token. Follow-up from the router review of #35688. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Session: https://cmux.com/deeplink/agent?id=aid-fb75b7af9902231028aa
|
All contributors have signed the CLA ✍️ ✅ |
|
Owned by an agent session · session |
|
Review (codex, router-review): SHIP at 6e60580 Reviewer: codex gpt-6.1-sol xhigh, fast tier. Follow-ups: 1. They land as checklist items in this PR's one follow-up tracking issue in this repo ( SHIP at 6e60580 Visual verdict: unchanged by this diff
Follow-ups:
|
|
cmux status (one comment, edited in place; each line is updated by the job that owns it) Merge receipt for |
Follow-up from the router review of #35688 (finding F1 at d5f6ec7).
gh_app_token.sh --reads-onlyclassifiedgh api graphql --input body.jsonand-F query=@file.graphqlas reads, because the query is not on the command line and the mutation check never sees it. A mutation sent that way would go out as the read-only App first. The App's refusal would then fall back to github.token, so nothing broke, but the mode's promise is that writes go out as github.token. Any GraphQL request whose body comes from a file or stdin (@file,--input) now counts as a write and goes out once as github.token.Nothing in nightly-next-tick's unstick job (the only user of the mode) sends GraphQL today, so this changes no current call.
Tests:
tests/test_gh_app_token.pyadds both forms to the write cases (each goes out once as github.token and is not retried).Agent session: agent session
🤖 Generated with Claude Code