Fix scheduled `update stars readme` job by switching to public starred API path

Merged

Copilotmerged intofrom

The update stars readme workflow failed with 403 Resource not accessible by integration because the job used the integration token against GET /user/starred. This change routes CI generation through the public user endpoint while preserving existing script behavior.

Root cause addressed
- scripts/generate_readme.py previously hardcoded https://api.github.com/user/starred, which requires token capabilities not available to this workflow token.
Script changes
- Added support for GITHUB_USERNAME/actor-driven fetch path.
- fetch_starred now selects:
  - https://api.github.com/users/{username}/starred when username is present
  - existing /user/starred path otherwise.
Workflow wiring
- Updated .github/workflows/update-stars.yml to pass:
  - GITHUB_USERNAME: ${{ github.repository_owner }}
- Kept existing token/env contract intact.

# .github/workflows/update-stars.yml
- name: Generate README
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    GITHUB_USERNAME: ${{ github.repository_owner }}
  run: python scripts/generate_readme.py

Activity

Initial plan

013cad8May 31

fix: use public starred API in workflow generation

d886794May 31

erbankuapproved changes5mo ago

erbanku merged commit 4d0491d into main5mo ago

kilo-code-bot[bot]reviewed5mo ago

kilo-code-bot[bot]5mo ago

Code Review Roast 🔥

Verdict: 4 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
🚨 critical	0
⚠️ warning	1
💡 suggestion	2
🤏 nitpick	1

🔍 Key Findings

1. Token sent to public API unnecessarily (scripts/generate_readme.py:45) The Bearer token is always included in the Authorization header, even when hitting the public /users/{username}/starred endpoint. That endpoint doesn't require auth — you're shouting your credentials at an endpoint that works fine without them.

2. No username validation before URL interpolation (scripts/generate_readme.py:29) (⚠️ warning) GITHUB_USERNAME is used directly in a URL template without checking it's a real, non-empty GitHub username. Pass an empty string and you'll construct https://api.github.com/users//starred. GitHub will 404, but proper input validation costs nothing.

3. .format() with unvalidated input in 2025 (scripts/generate_readme.py:42) We don't need to rehash f-string superiority, but using .format() on an unchecked env varirthat's going into a URL is lazy regardless of which string formatting method you pick.

🏆 Best part: The fallback to GITHUB_ACTOR shows you thought about CI edge cases — who knew?

💀 Worst part: Sending a Bearer token to a public API endpoint. Not a bug, but definitely a "my security audit will be angry" moment.

📊 Overall: Solid improvement — public API fallback is smart. Just validate your inputs and don't auth to endpoints that don't need it.

Files Reviewed (2 files)

scripts/generate_readme.py — 4 issues
.github/workflows/update-stars.yml — no issues

Fix these issues in Kilo Cloud

_{Reviewed by step-3.7-flash-20260528 · 1,984,660 tokens}

kilo-code-bot[bot]reviewed5mo ago

Branch copilot/fix-update-stars-readme-job has been merged.