p24-infra Docs

reviewer-github-app-operations

3 min read

reviewer-github-app — operations

The p24-reviewer GitHub App — a dedicated, least-privilege identity whose only job is posting PR reviews (APPROVE / REQUEST_CHANGES / comments) for the auto-review pipeline. It replaces the shared App 2109526 for the review approve step, isolating the review identity from 2109526’s contents:write / secrets:write / administration:write blast radius. Issue: #7478.

Full playbook: docs/playbooks/reviewer-github-app.md.

Status (2026-10-08)

Live and posting reviews, but its APPROVE does NOT count toward the required review (verified 2026-10-08 from worker logs, #7574): reviewDecision stays REVIEW_REQUIRED after a p24-reviewer APPROVE (authorAssociation: NONE, likely because the App has contents:read only). Owner decision 2026-10-08 (“option 2”, #7625): keep p24-reviewer review-only (no contents:write). So the counting approve = App 2109526 (p24-infra-admin) and p24-reviewer = comments / CHANGES_REQUESTED only. Components:

  • App created (App ID 5208530, installation ID 168439358), installed on all repositories of the radieu account (repository_selection: all, intentional — fleet-wide review identity).
  • scripts/gh-app-token --app reviewer — shipped (#7483, on main).
  • secrets/github-reviewer-app.env.sops — real values (REVIEWER_APP_ID / REVIEWER_APP_PRIVATE_KEY_B64 / REVIEWER_APP_INSTALLATION_ID), merged in #7516. Do not recreate.
  • infra/agent-prompts/review-pr-worker.md switch — applied (v3.2.0, #7595, 2026-10-08) and hardened (#7618): the worker posts p24-reviewer for comments / CHANGES_REQUESTED, and the counting APPROVE comes from App 2109526 (#6039). Per the #7625 decision the worker’s Phase 2 Step 7 should make App 2109526 the primary approve path (dropping the now-redundant reviewer-first-approve + reviewDecision second-approve) — that edit is a pending human-confirmed change to the protected: true worker file (tracked on #7625).

Architecture

  • Permissions (least-privilege): pull_requests:write, contents:read, issues:write, metadata:read (optional checks:write). No contents:write / secrets:write / administration:write / workflows:write — it cannot push code, mutate secrets, change settings, or merge.
  • Installation: all repositories of the radieu account (repository_selection: all, user decision 2026-10-06) — the fleet-wide review identity for every repo in REVIEW_REPOS (p24-infra, et-operational-platform, Art-Agency, radekkonarski-personal-brand, gmail-tools). The review-only permission set is what keeps a fleet-wide key safe.
  • Token flow: review-pr worker on bms-4 sops -d secrets/github-reviewer-app.env.sops → exports REVIEWER_APP_* → scripts/gh-app-token --app reviewer --permissions pull_requests:write mints a 1h installation token (os.environ-first resolution; separate cache /tmp/.gh-reviewer-app-token-cache). Token never persisted beyond that cache; private key never leaves SOPS.
  • Merge stays separate: approval is by p24-reviewer; merge (needs contents/admin) still runs via the existing worker/CI/App-2109526 path. Two distinct identities by design.

Secrets

secrets/github-reviewer-app.env.sops — REVIEWER_APP_ID, REVIEWER_APP_PRIVATE_KEY_B64, REVIEWER_APP_INSTALLATION_ID (only the private key is secret; App ID 5208530 and installation ID 168439358 are public). 3 recipients (developer + bms-4 infra-task worker key + lap2-windows, #7516). Excluded from secrets-sync.yml — no server plaintext .env, no sync job; the worker decrypts it directly on bms-4. Rekey via bms-4 SSH, not CI (AGE_KEY_GHA is not a recipient). Skipped in both CI SOPS-health jobs (self-test.yml #7538, sops-pr-canary.yml #7540) since CI cannot decrypt it.

Rotation

Monitoring / verification

scripts/gh-app-token --app reviewer --check      # exit 0 + "OK" on stderr once creds are real

Review activity is visible as p24-reviewer-authored reviews on PRs, and in the dev_r_worker_queue job_type=review-pr rows (see playbooks/ai-pr-auto-review.md).

Compliance

  • dev_r_services row: reviewer-github-app (tooling), compliance_workbook='yes'.
  • Not an AI system itself (it is the identity/transport for the review pipeline; the AI review logic lives in review-pr-worker.md / dev_r_ai_systems).

Graph View

Backlinks