Change assign-reviewer authorized integration token to a bot acct
What the developer wrote
Authored by Matt Corallo
Change assign-reviewer authorized integration token to a bot acct
I didn't realize using my own authorized integration token would
result in every assignment being listed as coming from me, which is
weird so here we swap it for a bot.
Fixes #4804
What changed, and why it matters
This commit swaps the ID number used by an automated workflow that randomly assigns code reviewers. The old number pointed to a real person's account, so the workflow's assignments appeared to come from that person. The new number points to a dedicated bot account. There is no security vulnerability here—just a cosmetic/accounting cleanup in project automation.
No security action needed. Treat as a normal repository-maintenance change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The change is in .forgejo/workflows/assign-reviewer.yml. It updates the audience parameter of an OIDC ID-token request from u:1:bec84b56-6f08-4622-9cd6-1aee5b18c5b9 to u:88:1a17a83c-eae2-4258-8b7f-34a9c9408cec. The audience value identifies which authorized integration (bot/app) the token is minted for. The commit message says the previous value was tied to the author’s own account, causing reviewer assignments to be attributed to them personally; the new value is a bot account. No secrets, credentials, or code logic are exposed or altered beyond this audience identifier.
Changed components
.forgejo/workflows/assign-reviewer.ymlInspect captured patch +1 / −1
diff --git a/.forgejo/workflows/assign-reviewer.yml b/.forgejo/workflows/assign-reviewer.yml
index 71fc81c..2e1ffb7 100644
--- a/.forgejo/workflows/assign-reviewer.yml
+++ b/.forgejo/workflows/assign-reviewer.yml
@@ -34,7 +34,7 @@ jobs:
id: jwt
run: |
set -eu
- jwt="$(curl -fsS -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=u:1:bec84b56-6f08-4622-9cd6-1aee5b18c5b9" | jq -r '.value')"
+ jwt="$(curl -fsS -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=u:88:1a17a83c-eae2-4258-8b7f-34a9c9408cec" | jq -r '.value')"
echo "::add-mask::$jwt"
echo "jwt=$jwt" >> "$FORGEJO_OUTPUT"
- name: Request review from a random developer
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.