github: bump gateway code-review to v0.4.4 (#10926)
What the developer wrote
Authored by Suheb
github: bump gateway code-review to v0.4.4 (#10926)
Bump the gateway-action pin to v0.4.4 (abe7cf8) and the runtime_ref to
gateway v0.4.4 (20675fc), and drop the hardcoded installation_id. As of
v0.4.4 the runtime resolves the App installation covering this repo from
app_id/private_key, so a static (and easily wrong-org) id is no longer
needed.
What changed, and why it matters
This commit updates a GitHub Actions workflow that runs an automated code-review bot called 'gateway'. It bumps the bot's version from v0.4.3 to v0.4.4 and removes a hardcoded numeric 'installation_id'. The new version figures out the correct installation ID automatically from the app's credentials. The change is a routine dependency/maintenance update for a CI/CD automation tool, not a fix for a known vulnerability in the LND software itself.
No immediate action required. Treat as routine CI maintenance. If reviewing for security, verify the new gateway-action SHA (abe7cf8) and runtime_ref SHA (20675fc) correspond to the officially released v0.4.4 artifacts from Lightning Labs, and confirm the GATEWAY_APP_ID and GATEWAY_PRIVATE_KEY secrets are scoped only to this repository/organization.
Security signals we found
Hardcoded installation_id removed, reducing risk of using a wrong-organization GitHub App installation
Action and runtime pinned to immutable commit SHAs (supply-chain best practice maintained)
No changes to LND runtime, wallet, channel, or network code
Evidence from the diff
The diff modifies .github/workflows/gateway.yml, pinning lightninglabs/gateway-action to abe7cf8 (v0.4.4) and the runtime_ref to 20675fc (gateway v0.4.4). It removes the static installation_id: 140960039 input because gateway v0.4.4 resolves the GitHub App installation dynamically from app_id and private_key. This is a workflow configuration change; no LND source code, cryptography, networking, or consensus logic is touched.
Changed components
.github/workflows/gateway.ymllightninglabs/gateway-action GitHub Actiongateway automated code-review runtimeInspect captured patch +7 / −4
diff --git a/.github/workflows/gateway.yml b/.github/workflows/gateway.yml
index e5d7cb9..eec70f8 100644
--- a/.github/workflows/gateway.yml
+++ b/.github/workflows/gateway.yml
@@ -30,12 +30,12 @@ jobs:
env:
GATEWAY_REVIEW_MODE: multi
steps:
- - uses: lightninglabs/gateway-action@fa29e3132c8af9cdabd9cedca3b1b6ece56d0982 # v0.4.3
+ - uses: lightninglabs/gateway-action@abe7cf894c5afd4e488caac4c72a4a268b65933e # v0.4.4
with:
# Pin the private runtime to an immutable commit (matches the action
# SHA-pin above) so runtime upgrades go through an lnd PR, not a moved
- # tag. Without this, runtime_ref defaults to the v0.4.3 tag.
- runtime_ref: bb11d9744cd6fe7fbeeb9de720fc8a74b5232a8e # gateway v0.4.3
+ # tag. Without this, runtime_ref defaults to the v0.4.4 tag.
+ runtime_ref: 20675fc28b157a7b4fcfbeddf7a2ca8e2115c387 # gateway v0.4.4
event_name: ${{ github.event_name }}
event_action: ${{ github.event.action }}
repo: ${{ github.repository }}
@@ -43,7 +43,10 @@ jobs:
actor: ${{ github.event.sender.login }}
comment_body: ${{ github.event.comment.body }}
comment_id: ${{ github.event.comment.id }}
- installation_id: 140960039
+ # installation_id intentionally omitted: as of gateway v0.4.4 the
+ # runtime resolves the App installation covering this repo from
+ # app_id/private_key, so a hardcoded (and easily wrong-org) id is no
+ # longer needed.
app_id: ${{ secrets.GATEWAY_APP_ID }}
private_key: ${{ secrets.GATEWAY_PRIVATE_KEY }}
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
Why this scored 21/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.