[SanilK2108]

Summary

common-app-server's image build fails as soon as a private app is pinned in hosted-api-apps.toml:

git ls-remote https://github.com/atlanhq/atlan-discovery-app.git refs/tags/v0.1.1  -> exit 128

The build job mints its git_token from git_auth.py repos, which only reads pyproject.toml and uv.lock. Apps hosted through hosted-api-apps.toml are cloned by the image build itself and reach uv.lock only as path dependencies (apps/<name>), so they were left out of the token's scope. Seen on atlanhq/common-app-server#227 (governance + discovery), whose Build & Publish failed on both arches while the PR image probe passed (it scopes its own token from scripts/token_repos.py, which does read that file).

Change

• referenced_repos also reads hosted-api-apps.toml and picks up each repo = "atlanhq/<name>". Only that file is read for repo = keys; commented lines are skipped like before.
• No change to the allowlist or the refusal logic: public repos are still dropped, and a non-aggregator naming a private repo is still refused. common-app-server is already in AGGREGATOR_REPOS.

Security note

This widens the image-build token for common-app-server to the private repos pinned in its hosted-api-apps.toml (read-only, same as the PR image probe's token already is). No other repo is affected unless it adds that file, and then the allowlist still applies.

Testing

• New test_referenced_repos_reads_hosted_api_app_pins; .github/scripts/tests/test_git_auth.py: 27 passed.
• ruff check / format clean.
• End to end: a common-app-server test branch calling this branch's reusable builds the APP-5256 Transformation time improvements, creator and enrichment #227 image (linked in a comment once it runs).

🤖 Generated with Claude Code

[linear]

FND-4206

[SanilK2108]

Proof: common-app-server #227 (hosts governance + discovery from hosted-api-apps.toml) builds through this branch. Run: https://github.com/atlanhq/common-app-server/actions/runs/42772102622 — Build amd64/arm64, Merge & Push Manifest and Security Gate all green. The same commit on @main failed at the private-repo clone (run 42768525226).

[vaibhavatlan]

/lens

[atlan-app-fleet]

lens summary · updated after round 2 (re-review · only commits since 81a87b0)

✅ Ready to merge — every finding is resolved

Open findings: 🔴 0 critical · 🟠 0 high · 🟡 0 medium · ⚪ 0 low (nit)

lens reads this PR as — The image-build token is scoped from git_auth.py repos, whose referenced_repos previously found git dependencies in pyproject.toml and uv.lock but not apps cloned from hosted-api-apps.toml. Those apps appear as local path dependencies in the lockfile, so a private app could be absent from the token scope and fail to clone during the image build. How: The change adds hosted-api-apps.toml as another input to referenced_repos, extracting its atlanhq/<name> pins. The existing private-repository filtering and refusal policy then apply as before, so the image-build token can include private hosted-app pins without changing the authorization mechanism.

Approach check — sound.

✔️ Resolved (1)

id	severity	where	finding	found	resolved	how
F-77addf	🟠 high	.github/scripts/git_auth.py:109	A multiline TOML string can widen the private-repo token scope	round 1	round 2	its code was removed or rewritten

🕘 Round history (2)

round	run	commits	new	resolved	blocking open	cost	log
1	first review	8b4edab..81a87b0	1	0	1	$0.016	run
2	re-review · only commits since 81a87b0	81a87b0..14c67a0	0	1	0	$0.022	run

1 file(s) with mechanical changes — proven behaviour-neutral in code, not sent to the model

• imports only: 1 file(s)

_{round 2 · $0.038 of $1.00 · 18 model calls · 0 failed requests · 71% prompt cache hits · gpt-6-luna}

[vaibhavatlan]

/lens

[atlan-app-fleet]

✅ lens · round 2 · re-review · only commits since 81a87b0 — ready to merge — every finding resolved · $0.04

Open findings: 🔴 0 critical · 🟠 0 high · 🟡 0 medium · ⚪ 0 low (nit)
Resolved this round: 1

Approach check — ✅ sound

• Problem: The image-build token is scoped from git_auth.py repos, whose referenced_repos previously found git dependencies in pyproject.toml and uv.lock but not apps cloned from hosted-api-apps.toml. Those apps appear as local path dependencies in the lockfile, so a private app could be absent from the token scope and fail to clone during the image build.
• How the PR solves it: The change adds hosted-api-apps.toml as another input to referenced_repos, extracting its atlanhq/<name> pins. The existing private-repository filtering and refusal policy then apply as before, so the image-build token can include private hosted-app pins without changing the authorization mechanism.

_{$0.038 of $1.00 · 18 model calls · 0 failed requests}

Full summary · Run log

[atlan-ci]

lens: ready to merge — every finding at every level is resolved (round 2).