Part

Bot identity

You might say: bot account, GitHub App, service account, automation token

The app, bot account, or token under which a run reads, writes, comments, and opens changes.

What it does

Makes actions attributable and gives the host a place to apply permissions and event-recursion rules.

Ask

Which actor made this change, which permissions does it have, and can its events start another run?

Typical

Repository token, app installation token, service account, or personal token used for automation.

Trouble

The actor has broad write access, actions are anonymous, or a token silently suppresses or causes recursive events.

What to look for

1. An author avatar or bot badge
2. An app name in an event or check
3. Token permission settings or an installation record

Connections

• See also: Least privilege
• See also: Webhook

Sources

1. GitHub, Triggering a workflow, Triggering a workflow from a workflowWhen you use the repository's GITHUB_TOKEN to perform tasks, events triggered by the GITHUB_TOKEN will not create a new workflow run, with the following exceptions.
2. GitHub, Use GITHUB_TOKEN for authentication in workflows, Modifying the permissions for the GITHUB_TOKENAs a good security practice, you should grant the GITHUB_TOKEN the least required access.

Use it on your project

teardown-apply: hold "Bot identity" (bot-identity) from the teardown at https://teardownatlas.com/software-factory/ against my project

Paste it into a coding agent that has the teardown skills.

An AI agent wrote this map with the teardown skill. It can contain errors: check the sources before you rely on a part. About and legal