feat(accounts): offer a repository's immutable name in the trust form

[alukach]

GitHub signs Actions tokens for repositories created after July 2026 (and any that opted in) with immutable subjects, repo:owner@id/repo@id:…, and a service account's trust has to match that form exactly. Nobody knows their repository's numeric ids, so today the trust form takes owner/repo, the exchange is refused, and the uniform refusal doesn't say why. This came up on the first real GitHub Actions run against staging: alukach/source-coop-upload-test is new, so its tokens say repo:alukach@897290/source-coop-upload-test@1400565438:ref:refs/heads/main. Part of #491.

What

GithubWorkflowFields, the fields behind both the create form and the "Trust a GitHub workflow" dialog:

• Public repository. When the Repository field holds owner/repo, the form asks https://api.github.com/repos/{owner}/{repo} once typing stops (400 ms) and offers the immutable name, octocat@583231/Hello-World@1296269, with Use it, which puts it in the field. The names come from GitHub's answer, so their case is GitHub's too.
• Private or missing repository. The anonymous API answers 404, so the form gives the command that prints the name for anyone who can see the repository: gh api repos/{owner}/{repo} --jq '"\(.owner.login)@\(.owner.id)/\(.name)@\(.id)"'. Run against the upload-test repository it prints alukach@897290/source-coop-upload-test@1400565438.
• A value already in the immutable form isn't looked up.
• "immutable subjects", in the Repository help and the private-repository line, links to GitHub's changelog, which says what the form is and which repositories get it: those created, renamed or transferred after July 15, 2026, plus any that opt in. The screenshots below predate the link, which adds only an underline.

Decisions to flag:

• It offers, it doesn't switch. Whether a repository's tokens carry the immutable form is its actions/oidc/customization/sub setting, which only its admins can read, even on a public repository. The creation date would only be a guess, so the form names the July 2026 default and leaves the choice to the user.
• Asked from the browser, not the server. The anonymous limit (60 requests an hour) is then the viewer's own rather than shared by every Vercel function, and the server needs no new code. The app sets no Content-Security-Policy, so nothing blocks the call. It does tell GitHub, from the viewer's IP, which repository name was typed, which is GitHub's own data.
• No GitHub sign-in for private repositories. That would mean a GitHub OAuth app and a token held for the session. The gh one-liner covers it for anyone who can already see the repository.

Stories

On this branch's deploy:

• GithubWorkflowFields › PublicRepository: https://source-coop-ui-git-feat-github-immutable-re-82950d-radiantearth.vercel.app/?path=/story/features-service-accounts-githubworkflowfields--public-repository (asks GitHub for real, so it shows octocat/Hello-World's actual ids)
• GithubWorkflowFields › PrivateRepository: https://source-coop-ui-git-feat-github-immutable-re-82950d-radiantearth.vercel.app/?path=/story/features-service-accounts-githubworkflowfields--private-repository

Testing

• GithubWorkflowFields.test.tsx (new, fetch mocked): a public repository's immutable name is offered and Use it sends it through onChange; a 404 shows the gh command; a value already immutable isn't looked up.
• src/stories.smoke.test.tsx: 193 pass, the two new stories included.
• npm run type-check and next lint on the changed files are clean.
• Screenshots above are from a local Storybook against the real GitHub API. The gh command was run against alukach/source-coop-upload-test and prints its token's subject prefix.

Docs and ADRs

Checked ADR-014 (source-cooperative/data.source.coop): it says a trust names a subject exactly, in either form, and this changes only how the form helps fill one in, so it still holds. docs.source.coop: the automated-access guide (source-cooperative/docs.source.coop#37) has its GitHub Actions section marked "coming soon", so no existing page describes this field. That section should mention the immutable form when it's written.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
source-coop-ui	Ready	Preview	Oct 1, 2026 9:25pm UTC
source-cooperative	Ready	Preview	Oct 1, 2026 9:25pm UTC

[claude]

Claude finished @alukach's task in 15s —— View job

---

✅ No blocking issues — safe to merge.

I read the diff for GithubWorkflowFields.tsx and its new test. I didn't run the tests or the type-check.

• Stale answers: answer?.repository === repository discards a response for an earlier value, and the effect aborts the in-flight request and clears the timer on every change. Both are handled correctly.
• Shell safety: the gh api command interpolates repository, but it is only rendered after the SHORT_REPOSITORY regex has matched. The regex allows only [A-Za-z0-9_.-], so the copied command can't contain shell metacharacters.
• Non-404 failures: a rate-limit response (403/429) or a network error also sets immutable: null. The form then says "GitHub doesn't show this repository publicly", which is wrong for a public repository. Anonymous browser calls are limited to 60 an hour, so this is plausible. The gh fallback still works, so it isn't blocking. If you want it accurate, treat only 404 as null and leave other failures as undefined (no hint shown).
• Dot-segment inputs: the regex accepts . and .. as segments, so a/.. is fetched. The browser normalizes the URL and GitHub returns an error, so it's harmless.

Simplify (ponytail)

Nothing worth cutting. The hook is small, the regex guards the shell command, and there is no new dependency.

Docs

The PR description covers this. It names ADR-014 in data.source.coop and says why it still holds, and it points to the "coming soon" GitHub Actions section of docs.source.coop#37. Nothing is missing.

---

💰 Estimated review cost: $0.13 · 0m15s · 4 turns