fix: repair the workflow v0.1.7 could not load, and move to client-id

.github/workflows/simplycubed-caller.yml

@@ -24,7 +24,7 @@ jobs:
     uses: simplycubed/code/.github/workflows/simplycubed.yml@main
     with:
       ref: ${{ github.event.issue.number }}
-      github-app-id: ${{ vars.SIMPLYCUBED_GH_APP_ID }}
+      github-app-client-id: ${{ vars.SIMPLYCUBED_GH_APP_CLIENT_ID }}
       issue-number: ${{ github.event.issue.number }}
       actor-login: ${{ github.event.sender.login }}
       azure-openai-endpoint: ${{ vars.AZURE_OPENAI_ENDPOINT }}
@@ -41,7 +41,7 @@ jobs:
     uses: simplycubed/code/.github/workflows/simplycubed.yml@main
     with:
       ref: ${{ github.event.pull_request.number }}
-      github-app-id: ${{ vars.SIMPLYCUBED_GH_APP_ID }}
+      github-app-client-id: ${{ vars.SIMPLYCUBED_GH_APP_CLIENT_ID }}
       pr-number: ${{ github.event.pull_request.number }}
       actor-login: ${{ github.event.review.user.login }}
       azure-openai-endpoint: ${{ vars.AZURE_OPENAI_ENDPOINT }}
@@ -65,7 +65,7 @@ jobs:
     uses: simplycubed/code/.github/workflows/simplycubed.yml@main
     with:
       ref: ${{ github.event.issue.number }}
-      github-app-id: ${{ vars.SIMPLYCUBED_GH_APP_ID }}
+      github-app-client-id: ${{ vars.SIMPLYCUBED_GH_APP_CLIENT_ID }}
       comment-body: ${{ github.event.comment.body }}
       issue-number: ${{ github.event.issue.pull_request == null && github.event.issue.number || '' }}
       pr-number: ${{ github.event.issue.pull_request != null && github.event.issue.number || '' }}

.github/workflows/simplycubed.yml

@@ -7,9 +7,17 @@ on:
         description: Issue or pull request number, used for concurrency.
         required: true
         type: string
+      github-app-client-id:
+        description: GitHub App Client ID for the SimplyCubed App, the Iv23 string
+          on the App settings page.
+        default: ""
+        required: false
+        type: string
       github-app-id:
-        description: GitHub App ID for the SimplyCubed App.
-        required: true
+        description: Deprecated, kept so an existing caller keeps working. Pass
+          github-app-client-id instead.
+        default: ""
+        required: false
         type: string
       issue-number:
         description: Issue number to run, when triggered from issues:labeled.
@@ -46,7 +54,7 @@ on:
         type: string
       version:
         description: SimplyCubed CLI tag to install.
-        default: v0.1.7
+        default: v0.1.8
         required: false
         type: string
     secrets:
@@ -72,7 +80,7 @@ jobs:
         id: app-token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          app-id: ${{ inputs['github-app-id'] }}
+          client-id: ${{ inputs['github-app-client-id'] || inputs['github-app-id'] }}
           private-key: ${{ secrets['github-app-private-key'] }}
           owner: ${{ steps.repo.outputs.owner }}
           repositories: ${{ steps.repo.outputs.name }}
@@ -108,12 +116,12 @@ jobs:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           AZURE_OPENAI_ENDPOINT: ${{ inputs['azure-openai-endpoint'] }}
           AZURE_OPENAI_API_KEY: ${{ secrets['azure-openai-api-key'] }}
+          COMMENT_BODY: ${{ inputs['comment-body'] }}
         # --base is explicit because actions/checkout never creates origin/HEAD,
         # which is the CLI's default base. The CLI resolves that case on its own
         # now, but naming the branch the event came from is exact rather than
         # inferred.
-        env:
-          COMMENT_BODY: ${{ inputs['comment-body'] }}
+        #
         # A comment goes through the parser, which recognises a fixed vocabulary
         # and does nothing otherwise. Without this every comment beginning with
         # the mention would start a full run, including "help" and including a
@@ -141,7 +149,7 @@ jobs:
         id: app-token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          app-id: ${{ inputs['github-app-id'] }}
+          client-id: ${{ inputs['github-app-client-id'] || inputs['github-app-id'] }}
           private-key: ${{ secrets['github-app-private-key'] }}
           owner: ${{ steps.repo.outputs.owner }}
           repositories: ${{ steps.repo.outputs.name }}
@@ -177,7 +185,6 @@ jobs:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           AZURE_OPENAI_ENDPOINT: ${{ inputs['azure-openai-endpoint'] }}
           AZURE_OPENAI_API_KEY: ${{ secrets['azure-openai-api-key'] }}
-        env:
           COMMENT_BODY: ${{ inputs['comment-body'] }}
         run: |
           if [ -n "${COMMENT_BODY}" ]; then

.github/workflows/tag-release.yml

@@ -33,7 +33,7 @@ jobs:
         id: app-token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          app-id: ${{ vars.SIMPLYCUBED_GH_APP_ID }}
+          client-id: ${{ vars.SIMPLYCUBED_GH_APP_CLIENT_ID }}
           private-key: ${{ secrets.SIMPLYCUBED_GH_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
           repositories: ${{ github.event.repository.name }}

CHANGELOG.md

@@ -3,6 +3,25 @@
 All notable changes are recorded here and summarized again in the matching
 GitHub release notes for each tag.
 
+## v0.1.8
+
+- **The Actions runtime was dead in `v0.1.7` and is fixed here.** The comment
+  dispatch fix gave the run step a second `env:` block instead of adding to the
+  first. YAML keeps the last of two identical keys, so `GH_TOKEN` and both Azure
+  variables were dropped, and GitHub, which is stricter than the parser the gate
+  used, refused to load the file at all. Every run since that merge failed in
+  about a second without starting a job. Upgrade from `v0.1.7`.
+- The gate now rejects a duplicate YAML key anywhere in a workflow, template, or
+  the embedded caller. `yaml.safe_load` accepted the broken file and kept the
+  last key, which is exactly why the break reached a release: green gate, dead
+  workflow. This is the second time a workflow defect passed a gate that only
+  compiled Go, and the check is written to fail on the real file from `v0.1.7`.
+- The App token step now uses `client-id`, which ends the deprecation warning
+  on every run. The two inputs are not interchangeable in principle, but the
+  action resolves `client-id || app-id` into one value, so adopters passing
+  `github-app-id` keep working while the documented path moves to
+  `SIMPLYCUBED_GH_APP_CLIENT_ID`.
+
 ## v0.1.7
 
 - Fixed comment commands. The reusable workflow declared `comment-body` and never

README.md

@@ -4,7 +4,7 @@
 
 An autonomous coding agent that lives inside your own GitHub. You file an issue, it opens a pull request, and a human decides whether to merge.
 
-> Beta, at `v0.1.7`. Product overview: [simplycubed.com/code](https://simplycubed.com/code?utm_source=github&utm_medium=readme&utm_campaign=code). See [Status](#status).
+> Beta, at `v0.1.8`. Product overview: [simplycubed.com/code](https://simplycubed.com/code?utm_source=github&utm_medium=readme&utm_campaign=code). See [Status](#status).
 
 ### Try it without letting it write anything
 
@@ -115,7 +115,7 @@ Start with the adopter quickstart in [docs/setup.md](docs/setup.md). It covers t
 Install the pinned release you want to run:
 
 ```sh
-go install github.com/simplycubed/code/cmd/simplycubed@v0.1.7
+go install github.com/simplycubed/code/cmd/simplycubed@v0.1.8
 simplycubed version
 ```
 
@@ -140,7 +140,7 @@ To run the loop inside your own GitHub Actions:
    Install it on the repo.
 2. In the adopter repo, run `simplycubed init --workflow`. That writes `.github/simplycubed.yml`, writes `.github/workflows/simplycubed.yml` pinned to a released reusable-workflow tag, and creates the `sc:*` labels through your local `gh` auth.
 3. Fill in the real `gate:` in `.github/simplycubed.yml`.
-4. Add repository variable `SIMPLYCUBED_GH_APP_ID`, repository secret `SIMPLYCUBED_GH_APP_PRIVATE_KEY`, repository variable `AZURE_OPENAI_ENDPOINT`, and repository secret `AZURE_OPENAI_API_KEY`.
+4. Add repository variable `SIMPLYCUBED_GH_APP_CLIENT_ID` (the App Client ID, the `Iv23` string on the App settings page), repository secret `SIMPLYCUBED_GH_APP_PRIVATE_KEY`, repository variable `AZURE_OPENAI_ENDPOINT`, and repository secret `AZURE_OPENAI_API_KEY`.
    These are per-repository and are never inherited from SimplyCubed: a reusable workflow runs with the calling repository's own variables and secrets, so you bring your own Azure endpoint and key, and pay for your own tokens.
    The private key secret must be the full PEM contents, including the `-----BEGIN` and `-----END` lines.
 5. Open a setup pull request in the adopter repo and merge it yourself. Setup files are written locally by `simplycubed init` and merged by a human, because the runtime holds no `workflows` permission and cannot add its own workflow files.
@@ -210,7 +210,7 @@ The first engine adapter targets the Codex CLI running against Azure OpenAI. Tod
 
 ## Status
 
-Beta, and honest about it. Two loops run end to end via the CLI on the Codex-on-Azure engine: issue to pull request, and fix-on-request (a human requests changes, the fixer addresses them and pushes back). `v0.1.7` is the latest release and you should still expect rough edges.
+Beta, and honest about it. Two loops run end to end via the CLI on the Codex-on-Azure engine: issue to pull request, and fix-on-request (a human requests changes, the fixer addresses them and pushes back). `v0.1.8` is the latest release and you should still expect rough edges.
 
 Roadmap, roughly in order:
 

STATUS.md

@@ -27,10 +27,14 @@ The Actions runtime authenticates as the `simplycubed-code[bot]` GitHub App.
 Each job mints its own installation token scoped to one repository with
 `contents`, `issues`, and `pull-requests` permissions only.
 
-`v0.1.6` is the current release. `go install
-github.com/simplycubed/code/cmd/simplycubed@v0.1.6` works today. `v0.1.2` and `v0.1.4` are retracted in `go.mod` because those tags pointed at the wrong
+`v0.1.8` is the current release. `go install
+github.com/simplycubed/code/cmd/simplycubed@v0.1.8` works today. `v0.1.2` and `v0.1.4` are retracted in `go.mod` because those tags pointed at the wrong
 commits.
 
+Do not use `v0.1.7`. Its copy of the reusable workflow has a duplicate `env:`
+key, which GitHub refuses to load, so every run under it fails in about a second
+without starting a job. `v0.1.8` is the fix.
+
 Both loops were dogfooded: the issue-to-PR loop produced the merged
 dependency-upgrade PR on `charlesgreen/gsm`.
 

cmd/simplycubed/main.go

@@ -131,7 +131,7 @@ gate:
 `
 
 const (
-	latestKnownWorkflowTag = "v0.1.7"
+	latestKnownWorkflowTag = "v0.1.8"
 	callerWorkflowTagToken = "__SIMPLYCUBED_TAG__"
 	simplycubedAppLogin    = "simplycubed-code[bot]"
 )
@@ -531,7 +531,7 @@ func initCmd(argv []string, stdout io.Writer) error {
 	fmt.Fprintln(stdout, "  - disable the App webhook, set install visibility to Any account, and install it on the repo")
 	fmt.Fprintln(stdout, "  - write the real gate in .github/simplycubed.yml")
 	fmt.Fprintln(stdout, "  - verify that gate is green on your main branch")
-	fmt.Fprintln(stdout, "  - set the SIMPLYCUBED_GH_APP_ID repo variable")
+	fmt.Fprintln(stdout, "  - set the SIMPLYCUBED_GH_APP_CLIENT_ID repo variable to the App Client ID, the Iv23 string on the App settings page")
 	fmt.Fprintln(stdout, "  - add the SIMPLYCUBED_GH_APP_PRIVATE_KEY repo secret with the full PEM, including BEGIN/END lines")
 	fmt.Fprintln(stdout, "  - set the AZURE_OPENAI_ENDPOINT repo variable")
 	fmt.Fprintln(stdout, "  - add the AZURE_OPENAI_API_KEY repo secret")

cmd/simplycubed/main_test.go

@@ -128,7 +128,7 @@ exit 0
 		"disable the App webhook, set install visibility to Any account, and install it on the repo",
 		"write the real gate in .github/simplycubed.yml",
 		"verify that gate is green on your main branch",
-		"set the SIMPLYCUBED_GH_APP_ID repo variable",
+		"set the SIMPLYCUBED_GH_APP_CLIENT_ID repo variable to the App Client ID",
 		"add the SIMPLYCUBED_GH_APP_PRIVATE_KEY repo secret with the full PEM, including BEGIN/END lines",
 		"set the AZURE_OPENAI_ENDPOINT repo variable",
 		"add the AZURE_OPENAI_API_KEY repo secret",
@@ -242,7 +242,7 @@ exit 0
 	}
 	for _, want := range []string{
 		"uses: simplycubed/code/.github/workflows/simplycubed.yml@v0.1.0",
-		"github-app-id: ${{ vars.SIMPLYCUBED_GH_APP_ID }}",
+		"github-app-client-id: ${{ vars.SIMPLYCUBED_GH_APP_CLIENT_ID }}",
 		"azure-openai-api-key: ${{ secrets.AZURE_OPENAI_API_KEY }}",
 		"github-app-private-key: ${{ secrets.SIMPLYCUBED_GH_APP_PRIVATE_KEY }}",
 	} {

cmd/simplycubed/simplycubed-caller.yml.tmpl

@@ -14,7 +14,7 @@ jobs:
     uses: simplycubed/code/.github/workflows/simplycubed.yml@__SIMPLYCUBED_TAG__
     with:
       ref: ${{ github.event.issue.number }}
-      github-app-id: ${{ vars.SIMPLYCUBED_GH_APP_ID }}
+      github-app-client-id: ${{ vars.SIMPLYCUBED_GH_APP_CLIENT_ID }}
       issue-number: ${{ github.event.issue.number }}
       actor-login: ${{ github.event.sender.login }}
       azure-openai-endpoint: ${{ vars.AZURE_OPENAI_ENDPOINT }}
@@ -30,7 +30,7 @@ jobs:
     uses: simplycubed/code/.github/workflows/simplycubed.yml@__SIMPLYCUBED_TAG__
     with:
       ref: ${{ github.event.pull_request.number }}
-      github-app-id: ${{ vars.SIMPLYCUBED_GH_APP_ID }}
+      github-app-client-id: ${{ vars.SIMPLYCUBED_GH_APP_CLIENT_ID }}
       pr-number: ${{ github.event.pull_request.number }}
       actor-login: ${{ github.event.review.user.login }}
       azure-openai-endpoint: ${{ vars.AZURE_OPENAI_ENDPOINT }}
@@ -53,7 +53,7 @@ jobs:
     uses: simplycubed/code/.github/workflows/simplycubed.yml@__SIMPLYCUBED_TAG__
     with:
       ref: ${{ github.event.issue.number }}
-      github-app-id: ${{ vars.SIMPLYCUBED_GH_APP_ID }}
+      github-app-client-id: ${{ vars.SIMPLYCUBED_GH_APP_CLIENT_ID }}
       comment-body: ${{ github.event.comment.body }}
       issue-number: ${{ github.event.issue.pull_request == null && github.event.issue.number || '' }}
       pr-number: ${{ github.event.issue.pull_request != null && github.event.issue.number || '' }}

cmd/simplycubed/simplycubed-selftest.yml.tmpl

@@ -34,7 +34,7 @@ jobs:
         id: app-token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          app-id: ${{ vars.SIMPLYCUBED_GH_APP_ID }}
+          client-id: ${{ vars.SIMPLYCUBED_GH_APP_CLIENT_ID }}
           private-key: ${{ secrets.SIMPLYCUBED_GH_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
           repositories: ${{ github.event.repository.name }}

docs/setup.md

@@ -16,7 +16,7 @@ Prerequisites:
 1. Install the CLI:
 
 ```sh
-go install github.com/simplycubed/code/cmd/simplycubed@v0.1.7
+go install github.com/simplycubed/code/cmd/simplycubed@v0.1.8
 simplycubed version
 ```
 
@@ -56,7 +56,7 @@ simplycubed run owner/repo#N --repo-dir .
 
 4. In the GitHub repository settings, add:
 
-- Variable: `SIMPLYCUBED_GH_APP_ID`
+- Variable: `SIMPLYCUBED_GH_APP_CLIENT_ID`, the App Client ID, the `Iv23` string on the App settings page
 - Secret: `SIMPLYCUBED_GH_APP_PRIVATE_KEY`
 - Variable: `AZURE_OPENAI_ENDPOINT`
 - Secret: `AZURE_OPENAI_API_KEY`
@@ -119,7 +119,7 @@ flowchart TB
     end
 
     subgraph actions["GitHub Actions: the App is the identity"]
-        A1["repository variables<br/>AZURE_OPENAI_ENDPOINT<br/>SIMPLYCUBED_GH_APP_ID"]
+        A1["repository variables<br/>AZURE_OPENAI_ENDPOINT<br/>SIMPLYCUBED_GH_APP_CLIENT_ID"]
         A2["repository secrets<br/>AZURE_OPENAI_API_KEY<br/>SIMPLYCUBED_GH_APP_PRIVATE_KEY"]
         A3["per-job installation token<br/>contents, issues, pull requests"]
         A4["simplycubed run / address"]
@@ -191,7 +191,8 @@ passes:
   `azure-openai-endpoint`.
 - `secrets.AZURE_OPENAI_API_KEY` to the reusable workflow secret
   `azure-openai-api-key`.
-- `vars.SIMPLYCUBED_GH_APP_ID` to the reusable workflow input `github-app-id`.
+- `vars.SIMPLYCUBED_GH_APP_CLIENT_ID` to the reusable workflow input
+  `github-app-client-id`.
 - `secrets.SIMPLYCUBED_GH_APP_PRIVATE_KEY` to the reusable workflow secret
   `github-app-private-key`.
 

docs/templates/simplycubed-caller.yml

@@ -11,10 +11,10 @@ on:
 jobs:
   run:
     if: ${{ github.event_name == 'issues' && github.event.label.name == 'sc:go' }}
-    uses: simplycubed/code/.github/workflows/simplycubed.yml@v0.1.7
+    uses: simplycubed/code/.github/workflows/simplycubed.yml@v0.1.8
     with:
       ref: ${{ github.event.issue.number }}
-      github-app-id: ${{ vars.SIMPLYCUBED_GH_APP_ID }}
+      github-app-client-id: ${{ vars.SIMPLYCUBED_GH_APP_CLIENT_ID }}
       issue-number: ${{ github.event.issue.number }}
       actor-login: ${{ github.event.sender.login }}
       azure-openai-endpoint: ${{ vars.AZURE_OPENAI_ENDPOINT }}
@@ -27,10 +27,10 @@ jobs:
     if: >-
       github.event_name == 'pull_request_review' &&
       contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.review.author_association)
-    uses: simplycubed/code/.github/workflows/simplycubed.yml@v0.1.7
+    uses: simplycubed/code/.github/workflows/simplycubed.yml@v0.1.8
     with:
       ref: ${{ github.event.pull_request.number }}
-      github-app-id: ${{ vars.SIMPLYCUBED_GH_APP_ID }}
+      github-app-client-id: ${{ vars.SIMPLYCUBED_GH_APP_CLIENT_ID }}
       pr-number: ${{ github.event.pull_request.number }}
       actor-login: ${{ github.event.review.user.login }}
       azure-openai-endpoint: ${{ vars.AZURE_OPENAI_ENDPOINT }}
@@ -50,10 +50,10 @@ jobs:
       github.event.comment.user.type != 'Bot' &&
       startsWith(github.event.comment.body, '@simplycubed-code') &&
       contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
-    uses: simplycubed/code/.github/workflows/simplycubed.yml@v0.1.7
+    uses: simplycubed/code/.github/workflows/simplycubed.yml@v0.1.8
     with:
       ref: ${{ github.event.issue.number }}
-      github-app-id: ${{ vars.SIMPLYCUBED_GH_APP_ID }}
+      github-app-client-id: ${{ vars.SIMPLYCUBED_GH_APP_CLIENT_ID }}
       comment-body: ${{ github.event.comment.body }}
       issue-number: ${{ github.event.issue.pull_request == null && github.event.issue.number || '' }}
       pr-number: ${{ github.event.issue.pull_request != null && github.event.issue.number || '' }}

docs/templates/simplycubed-selftest.yml

@@ -34,7 +34,7 @@ jobs:
         id: app-token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          app-id: ${{ vars.SIMPLYCUBED_GH_APP_ID }}
+          client-id: ${{ vars.SIMPLYCUBED_GH_APP_CLIENT_ID }}
           private-key: ${{ secrets.SIMPLYCUBED_GH_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
           repositories: ${{ github.event.repository.name }}

docs/troubleshooting.md

@@ -92,7 +92,8 @@ Pull requests opened with a `GITHUB_TOKEN` do not trigger other workflows. If
 your required checks never appear on the agent's pull requests, the run is
 authenticating with the default token rather than the App.
 
-Check that `SIMPLYCUBED_GH_APP_ID` and `SIMPLYCUBED_GH_APP_PRIVATE_KEY` are set.
+Check that `SIMPLYCUBED_GH_APP_CLIENT_ID` and `SIMPLYCUBED_GH_APP_PRIVATE_KEY`
+are set.
 The self-test's first step fails when they are missing or wrong.
 
 ## The run was refused before it started