build(deps): bump actions/create-github-app-token from 2.2.2 to 3.2.0 by dependabot[bot] · Pull Request #7 · patrickryankenneth/python-wheels-builder

dependabot · 2026-10-03T23:01:04Z

Bumps actions/create-github-app-token from 2.2.2 to 3.2.0.

Release notes

Sourced from actions/create-github-app-token's releases.

v3.2.0

3.2.0 (2026-05-12)

Features

add support for enterprise-level GitHub Apps (#263) (952a2a7)

support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

deps: bump @actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)

validate private-key input (#376) (f24bbd8)

v3.1.1

3.1.1 (2026-04-11)

Bug Fixes

improve error message when app identifier is empty (#362) (07e2b76), closes #249

v3.1.0

3.1.0 (2026-04-11)

Bug Fixes

deps: bump p-retry from 7.1.1 to 8.0.0 (#357) (3bbe07d)

Features

add client-id input and deprecate app-id (#353) (e6bd4e6)

update permission inputs (#358) (076e948)

v3.0.0

3.0.0 (2026-03-14)

feat!: node 24 support (#275) (2e564a0)

fix!: require NODE_USE_ENV_PROXY for proxy support (#342) (4451bcb)

Bug Fixes

remove custom proxy handling (#143) (dce0ab0)

... (truncated)

Changelog

Sourced from actions/create-github-app-token's changelog.

Changelog

3.2.0 (2026-05-12)

Features

add support for enterprise-level GitHub Apps (#263) (952a2a7)

support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

deps: bump @actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)

validate private-key input (#376) (f24bbd8)

Commits

bcd2ba4 chore(main): release 3.2.0 (#370)
f24bbd8 fix: validate private-key input (#376)
363531b docs: capitalize Git as a proper noun in README (#374)
fd28011 docs: update procedure to configure Git (#287)
85eb8dd feat: support full repository names in repositories input (#372)
c9aabb8 build(deps-dev): bump yaml from 2.8.3 to 2.8.4 in the development-dependencie...
e02e816 build(deps-dev): bump undici from 7.24.6 to 8.2.0 (#366)
8d835bf build(deps-dev): bump esbuild from 0.27.4 to 0.28.0 in the development-depend...
952a2a7 feat: add support for enterprise-level GitHub Apps (#263)
43e5c34 fix(deps): bump @actions/core from 3.0.0 to 3.0.1 in the production-dependenc...
Additional commits viewable in compare view

Summary by CodeRabbit

Chores
- Updated internal automation configuration. There are no changes to app features or behavior.

cloudflare-workers-and-pages · 2026-10-03T23:01:06Z

Deploying python-wheels-builder with Cloudflare Pages

Latest commit:	`1374fad`
Status:	✅ Deploy successful!
Preview URL:	https://9a2843f2.python-wheels-builder.pages.dev
Branch Preview URL:	https://dependabot-github-actions-ac.python-wheels-builder.pages.dev

View logs

coderabbitai · 2026-10-11T03:04:26Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 5047120e-72c9-4f3e-b964-d84ba02ef4da

📥 Commits

Reviewing files that changed from the base of the PR and between 182118f and 1374fad.

📒 Files selected for processing (1)

.github/workflows/merge-bot.yml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

📝 Walkthrough

Walkthrough

The merge and pull request bot workflows now use actions/create-github-app-token v3.2.0. No other behavior changes are shown.

Changes

GitHub App token action update

Layer / File(s)	Summary
Update token action versions `.github/workflows/merge-bot.yml`, `.github/workflows/pull-request-bot.yml`	Both workflows now use `actions/create-github-app-token` v3.2.0 instead of v2.2.2.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Other

Suggested reviewers: patrickryankenneth

Merge Risk | ⚪ Minimal · up to 1374f

Merge Risk: ⚪ Minimal · up to 1374f

Both bot workflows now use the v3.2.0 token action. Their configured inputs and hosted runner environment are compatible, with no actionable merge-blocking risk established.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 1374f

The bots retain their repository limits, explicit permissions, and existing consumers. No introduced vulnerability was established. Remaining uncertainty concerns the upgraded credential dependency’s runtime and interruption behavior, rather than an observed expansion of bot authority.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

inferred — The requested installation tokens are scoped to the event repository and the workflows’ explicit permissions. The action itself receives two apps’ private keys across separate jobs, so its maximum potential authority depends on those apps’ installation grants, which are not supplied. This credential trust relationship predates the PR.

Trust Boundaries and Controls

observed — With these callers, the upgraded action resolves the repository owner from GITHUB_REPOSITORY_OWNER and forwards the named repository and explicit permissions to installation authentication. Its enterprise-wide path requires an enterprise input absent from both workflows; qualified repository names with a mismatched owner are rejected.
observed — The merge job retains its prerequisite jobs, same-repository restriction, environment reference, compare-status check, and non-force update. Both workflows retain cancel-in-progress controls, and the PR consumer retains its existing-PR lookup before create or edit. These controls predate the upgrade and do not establish atomic execution across cancellation or concurrent API requests.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: updating actions/create-github-app-token from version 2.2.2 to 3.2.0.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

deepsource-io · 2026-10-11T03:04:33Z

DeepSource Code Review

We reviewed changes in 462ef7c...1374fad on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade	Security Reliability Complexity Hygiene

Code Review Summary

Analyzer	Updated (UTC)	Details
Python	Oct 11, 2026 7:40p.m.	Review ↗
Shell	Oct 11, 2026 7:40p.m.	Review ↗
Secrets	Oct 11, 2026 7:40p.m.	Review ↗
Docker	Oct 11, 2026 7:40p.m.	Review ↗
Rust	Oct 11, 2026 7:40p.m.	Review ↗
PowerShell	Oct 11, 2026 7:40p.m.	Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

Bumps [actions/create-github-app-token](https://github.com/actions/create-github-app-token) from 2.2.2 to 3.2.0. - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md) - [Commits](actions/create-github-app-token@fee1f7d...bcd2ba4) --- updated-dependencies: - dependency-name: actions/create-github-app-token dependency-version: 3.2.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 3, 2026

dependabot Bot force-pushed the dependabot/github_actions/actions/create-github-app-token-3.2.0 branch 7 times, most recently from 64e9a2f to 78946ec Compare October 5, 2026 01:05

dependabot Bot force-pushed the dependabot/github_actions/actions/create-github-app-token-3.2.0 branch from 78946ec to 577418e Compare October 11, 2026 03:04

dependabot Bot force-pushed the dependabot/github_actions/actions/create-github-app-token-3.2.0 branch from 577418e to 182118f Compare October 11, 2026 04:15

dependabot Bot force-pushed the dependabot/github_actions/actions/create-github-app-token-3.2.0 branch from 182118f to 1374fad Compare October 11, 2026 19:40

Navigation Menu

Repository navigation

build(deps): bump actions/create-github-app-token from 2.2.2 to 3.2.0 - #7

build(deps): bump actions/create-github-app-token from 2.2.2 to 3.2.0#7
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/create-github-app-token-3.2.0

dependabot Bot commented on behalf of github Oct 3, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Oct 3, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 11, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

deepsource-io Bot commented Oct 11, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 3, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v3.2.0

3.2.0 (2026-05-12)

Features

Bug Fixes

v3.1.1

3.1.1 (2026-04-11)

Bug Fixes

v3.1.0

3.1.0 (2026-04-11)

Bug Fixes

Features

v3.0.0

3.0.0 (2026-03-14)

Bug Fixes

Changelog

3.2.0 (2026-05-12)

Features

Bug Fixes

Summary by CodeRabbit

Uh oh!

cloudflare-workers-and-pages Bot commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying python-wheels-builder with Cloudflare Pages

Uh oh!

coderabbitai Bot commented Oct 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

deepsource-io Bot commented Oct 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DeepSource Code Review

PR Report Card

Code Review Summary

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 3, 2026 •

edited by coderabbitai Bot

Loading

cloudflare-workers-and-pages Bot commented Oct 3, 2026 •

edited

Loading

coderabbitai Bot commented Oct 11, 2026 •

edited

Loading

deepsource-io Bot commented Oct 11, 2026 •

edited

Loading