Update Ditto authentication to use App ID and Playground Token#247
Closed
Alyssa Evans (alycda) wants to merge 3 commits intodependabot/npm_and_yarn/javascript-tui/undici-6.24.1from
Closed
Conversation
Bumps [undici](https://github.com/nodejs/undici) from 6.23.0 to 6.24.1. - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v6.23.0...v6.24.1) --- updated-dependencies: - dependency-name: undici dependency-version: 6.24.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
…nt action
The DITTO_API_KEY and DITTO_API_URL secrets were not configured in the
repository, causing the curl command to fail with exit code 6 (empty
host/token). Switch to the existing DITTO_APP_ID and DITTO_PLAYGROUND_TOKEN
secrets, constructing the API URL as {app-id}.cloud.ditto.live.
Updates the action inputs and all 5 affected workflows.
https://claude.ai/code/session_01TPYeFrThWGY2KgASaZZ83D
Alyssa Evans (alycda)
added
the
javascript
Alyssa Evans (alycda)
requested review from
Hamilton Chapman (hamchapman)
and removed request for
a team
dependabot
bot
force-pushed
the
dependabot/npm_and_yarn/javascript-tui/undici-6.24.1
branch
from
54314c1 to
5f4c829
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the Ditto Cloud seeding/authentication used by the seed-ditto-document composite action and a subset of CI workflows to authenticate via App ID + Playground Token and to construct the API endpoint from the App ID.
Changes:
- Updated
.github/actions/seed-ditto-documentinputs and request construction to useditto-app-id+ditto-playground-token. - Updated multiple CI workflows to pass
DITTO_APP_ID/DITTO_PLAYGROUND_TOKENinto the seed action instead ofDITTO_API_URL/DITTO_API_KEY. - Included
javascript-tui/package-lock.jsonchanges that modify resolved dependencies (e.g.,undicibump).
Reviewed changes
Copilot reviewed 6 out of 7 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
.github/actions/seed-ditto-document/action.yml |
Swaps seed action auth inputs to App ID + Playground Token and changes the constructed Ditto API URL. |
.github/workflows/cpp-tui-ci.yml |
Passes new seed action inputs (DITTO_APP_ID, DITTO_PLAYGROUND_TOKEN). |
.github/workflows/dotnet-tui-ci.yml |
Passes new seed action inputs (DITTO_APP_ID, DITTO_PLAYGROUND_TOKEN). |
.github/workflows/dotnet-winforms-ci.yml |
Passes new seed action inputs (DITTO_APP_ID, DITTO_PLAYGROUND_TOKEN). |
.github/workflows/javascript-tui-ci.yml |
Passes new seed action inputs (DITTO_APP_ID, DITTO_PLAYGROUND_TOKEN). |
.github/workflows/rust-tui-ci.yml |
Passes new seed action inputs (DITTO_APP_ID, DITTO_PLAYGROUND_TOKEN). |
javascript-tui/package-lock.json |
Updates lockfile resolution (includes an undici version bump and removal of a top-level react-devtools-core entry). |
Files not reviewed (1)
- javascript-tui/package-lock.json: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
Comment on lines
+13208
to
13212
| "version": "6.24.1", | ||
| "resolved": "https://registry.npmjs.org/undici/-/undici-6.24.1.tgz", | ||
| "integrity": "sha512-sC+b0tB1whOCzbtlx20fx3WgCXwkW627p4EA9uM+/tNNPkSS+eSEld6pAs9nDv7WbY1UUljBMYPtu9BCOrCWKA==", | ||
| "license": "MIT", | ||
| "peer": true, |
…ecrets Per Copilot review: 11 more workflows had inline curl calls still using the non-existent DITTO_API_KEY and DITTO_API_URL secrets. Migrate them all to DITTO_PLAYGROUND_TOKEN and construct the URL from DITTO_APP_ID. Also apply curl robustness fix from Copilot review: use -fSs instead of -s so network/DNS/TLS failures fail fast rather than producing empty responses that cause misleading HTTP_CODE parsing. Add set -euo pipefail to the reusable action. https://claude.ai/code/session_01TPYeFrThWGY2KgASaZZ83D
Bulzan Sergiu (busec0)
requested changes
Mar 18, 2026
Member
Bulzan Sergiu (busec0)
left a comment
Bulzan Sergiu (busec0)
left a comment
There was a problem hiding this comment.
This failed because Dependabot did not have access to the secrets, not because our authentication was faulty. Can probably be closed.
dependabot
bot
deleted the branch
dependabot/npm_and_yarn/javascript-tui/undici-6.24.1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Updated the Ditto Cloud authentication mechanism across all CI workflows and the seed action to use App ID and Playground Token instead of API Key and API URL.
Key Changes
seed-ditto-document action:
ditto-api-keyinput withditto-playground-tokenditto-api-urlinput withditto-app-idhttps://{app-id}.cloud.ditto.live/api/v4/store/executeCI Workflows: Updated all 6 workflow files to pass the new secret names:
cpp-tui-ci.ymldotnet-tui-ci.ymldotnet-winforms-ci.ymljavascript-tui-ci.ymlrust-tui-ci.ymlDITTO_APP_IDandDITTO_PLAYGROUND_TOKENsecrets instead ofDITTO_API_KEYandDITTO_API_URLImplementation Details
The API endpoint URL is now constructed dynamically using the App ID as a subdomain prefix, eliminating the need for a separate API URL configuration. This simplifies the authentication setup and aligns with Ditto Cloud's current authentication standards.
https://claude.ai/code/session_01TPYeFrThWGY2KgASaZZ83D