[cb-logesh]

Summary

• use the public Chargebee GitHub App credentials when creating automated reconciliation PRs
• keep the installation token restricted to chargebee/cli
• retain only contents: write and pull-requests: write permissions

Required configuration

Add CB_PUBLIC_APP_ID and CB_PUBLIC_PEM_KEY to chargebee/cli, either as repository Actions secrets or chargebee organization secrets shared with this repository. Both values must belong to the GitHub App already installed on chargebee/cli.

Validation

• git diff --check
• YAML syntax validation

The reconciliation workflow now uses CB_PUBLIC_APP_ID and CB_PUBLIC_PEM_KEY to create its GitHub App token. The token is limited to the chargebee/cli repository with contents: write and pull-requests: write permissions.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

The OpenAPI reconciliation workflow now creates its GitHub App token with CB_PUBLIC_APP_ID and CB_PUBLIC_PEM_KEY instead of the SDK bot credentials.

Changes

OpenAPI Reconciliation

Layer / File(s)	Summary
GitHub App token credentials .github/workflows/reconcile-openapi.yml	The token step now uses the public app ID and private key secrets.

Priority: Not assessed

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Possibly related PRs

• chargebee/cli#19: Introduced the reconciliation workflow and its GitHub App installation-token step.

Merge Risk: Minimal · up to fe673

The workflow wiring is mergeable; the matching public App secrets must be provisioned in GitHub settings.

- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Test coverage

✅ Gate passed — all 78 files are at or above the 95% floor.

Status	Metric	Coverage	Threshold
✅	Functions	99.90%	95%
✅	Lines	99.45%	95%

[cb-logesh]

Closing because the public Chargebee organization intentionally exposes the same App credentials under the existing CB_SDK_BOT_APP_ID and CB_SDK_BOT_PEM_KEY names. The workflow on main already references those names, so no code change is required.