[imanimanyara]

Summary

A package may require a private repository in another owner through a vcs repository, which is laranail's documented way of resolving inter-package dependencies. The reusable security.yml could not install such a package at all, so it could not scan it.

Adds two optional inputs and one optional secret. A caller that sets none behaves exactly as before.

private-dependency-owner	owner holding the private repositories (e.g. simtabi). Empty by default
private-dependency-repos	optional comma-separated names, to narrow the token
REFRESH_APP_PRIVATE_KEY	optional secret; client id comes from the caller's vars.REFRESH_APP_CLIENT_ID

What it failed with, and why that matters

laranail/sis-wrapper requires simtabi/sis-sdk, which is private and in a different org:

Failed to execute git clone --mirror -- ***github.com/simtabi/sis-sdk.git
remote: Invalid username or token. Password authentication is not supported for Git operations.

A workflow's GITHUB_TOKEN is scoped to the calling repository, so it cannot clone anything in another owner. The failure surfaces as an authentication error inside composer install — which reads as a dependency problem, several steps from its cause. sis-wrapper's own workflows already carry a comment saying exactly that, and already solve it; the shared workflow did not.

Why the caller cannot just pass a token

A jobs.<id>.uses: job runs no steps of its own, so a caller cannot mint an installation token and hand it over. The minting has to happen inside the reusable workflow. That is why this takes a private key and an owner rather than a ready-made token.

Three details that are not optional

• The token is minted per run, scoped to that owner with permission-contents: read, and nothing long-lived is stored.
• A set owner with no key fails loudly, with an error naming the missing variable and secret, rather than falling through to GITHUB_TOKEN and producing the confusing clone failure above. A missing credential is a configuration fault and should say so.
• git config url.insteadOf is required, not belt-and-braces. Composer clones the plain https URL and offers the token as <token>:x-oauth-basic, which GitHub refuses for an app installation token. The rewrite supplies the documented x-access-token:<token> form so the first attempt is the correct one. This is sis-wrapper's own hard-won finding, generalised.

Verified

• 2 mint steps, 2 require-token guards, 2 insteadOf rewrites — one set per composer-installing job (composer-audit, osv-scan); secret-scan installs nothing and needs none.
• YAML parses; jobs composer-audit, osv-scan, secret-scan intact; inputs now php-version, php-extensions, private-dependency-owner, private-dependency-repos; secrets OP_SERVICE_ACCOUNT_TOKEN, REFRESH_APP_PRIVATE_KEY, both optional.
• actions/create-github-app-token@v3 floats on its major tag, per the first-party rule.

Follow-up

laranail/sis-wrapper#51 can then pass private-dependency-owner: simtabi and private-dependency-repos: sis-sdk. Its local deploy-key path stays as it is; this is the app-token route only.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.