shopify_api 16.3.0 → 16.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6ef28917f2c106b9f37d8bbe2d84a870da064c05dc9a1c962adabc3e1c554990
-  data.tar.gz: 3f09f7a81bd0fb124e449c2025a228588a0d2e23f9ccff7db26ef321e33685f8
+  metadata.gz: cbd548afc86fb40ff24448ff45e03de8cc03f447ccd8e720f547fa68928c0bff
+  data.tar.gz: 7fa251cefb79e6425b74c30c0249d6f8e814c8d7c6a4e96e9f8c97c539aae54c
 SHA512:
-  metadata.gz: 617d78c0c104967dfda7f676807563d1c41e01c76ffa063d66728c77f2463fc13cc8e7b1316743c09997c793c98a4c679b1c2848098864131ddabf09653ba509
-  data.tar.gz: 0c1ec1644cca56fcb2df2f5d55fefa5f692cbe7f8b2800e398a5cb1e7be462ff84e9d14065090e2441f0c725565c9916919b2fa1fd7c965e63e00fbbe8ef344a
+  metadata.gz: a9fe21c59123c41d4256a0560be7d110594019a469105590cdd6ada7aec5b087aff847797f47ce9e1e0c6c571ad8d80cb156ec17435be1146d8d854e9d3ee7b8
+  data.tar.gz: c0b10efdc9650f3a8caf9074796b192deb4bec47059db2d76755ecac0ae28e10125b03cab5780256e25d61bd375cd698360d89f3cd4bf7d43e533dd03970f2d3

data/.github/workflows/close-waiting-for-response-issues.yml

@@ -3,18 +3,24 @@ on:
   schedule:
     - cron: "30 1 * * *"
   workflow_dispatch:
+
+permissions:
+  actions: write
+  issues: write
+
 jobs:
   check-need-info:
     runs-on: ubuntu-latest
     steps:
-      - name: close-issues
-        uses: actions-cool/issues-helper@45d75b6cf72bf4f254be6230cb887ad002702491 # v3.6.3
+      - name: Close inactive issues
+        uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
         with:
-          actions: 'close-issues'
-          token: ${{ secrets.GITHUB_TOKEN }}
-          labels: 'Waiting for Response'
-          inactive-day: 14
-          body: |
+          days-before-stale: -1
+          days-before-close: -1
+          days-before-issue-close: 14
+          stale-issue-label: "Waiting for Response"
+          remove-issue-stale-when-updated: false
+          close-issue-message: |
             We are closing this issue because we did not hear back regarding additional details we needed to resolve this issue. If the issue persists and you are able to provide the missing clarification we need, feel free to create a new issue with the additional information.
 
             We appreciate your understanding as we try to manage our number of open issues.

data/CHANGELOG.md

@@ -3,6 +3,20 @@
 Note: For changes to the API, see https://shopify.dev/changelog?filter=api
 ## Unreleased
 
+## 16.4.0 (2026-11-05)
+- [#1481](https://github.com/Shopify/shopify-api-ruby/pull/1481) `ShopifyAPI::Auth::TokenExchange.exchange_token` now raises `ShopifyAPI::Errors::InvalidJwtTokenError` when token exchange rejects the session token with `invalid_identity_session`, matching the existing `invalid_subject_token` handling.
+- [#1475](https://github.com/Shopify/shopify-api-ruby/pull/1475) Add an optional `client_assertion:` argument to `ShopifyAPI::Auth::ClientCredentials.client_credentials`. When supplied, the token request authenticates with a JWT client assertion and sends no client secret. Omitting it, or passing `nil`, keeps the existing client-secret behavior. See the [OAuth documentation](docs/usage/oauth.md#client-assertion-authentication).
+- [#1475](https://github.com/Shopify/shopify-api-ruby/pull/1475) Add `ShopifyAPI::Auth::ClientAssertion.create`, an optional helper that signs a client assertion with an `RS256` (RSA, 2048-bit minimum) or `ES256` (EC P-256) private key your app owns. `client_id` defaults to `ShopifyAPI::Context.api_key`, the only value the helper reads from the context, and it never generates, imports, stores, or rotates keys.
+- [#1475](https://github.com/Shopify/shopify-api-ruby/pull/1475) Add `ShopifyAPI::Errors::InvalidClientAssertionError`, raised for a blank or non-`String` assertion, for an assertion with surrounding whitespace, and for invalid signer input.
+- [#1475](https://github.com/Shopify/shopify-api-ruby/pull/1475) For client-assertion token requests only, send HTTParty's inherited Basic and digest authentication as `nil`, so a single-use assertion is never replayed against a digest challenge, and reject a URL that carries userinfo before I/O. The HTTP transport, connection settings, non-credential headers, and global HTTParty defaults are unchanged, and everything else in global HTTParty state stays the caller's responsibility.
+- ⚠️ [Behavior change] [#1475](https://github.com/Shopify/shopify-api-ruby/pull/1475) `ShopifyAPI::Auth::ClientCredentials.client_credentials` no longer follows redirects, with either authentication method, and raises `ShopifyAPI::Errors::HttpResponseError` naming the status and the target instead. A 307 or 308 would otherwise forward the credential-bearing request body to the redirect target. This changes the existing client-secret path, including for apps that enabled redirects through global HTTParty defaults; no request is sent to the redirect target. Other operations keep their redirect policy.
+  - Limitation: this applies to the client-credentials token request only. `ShopifyAPI::Auth::Oauth.validate_auth_callback`, both `ShopifyAPI::Auth::TokenExchange` requests (`exchange_token` and `migrate_to_expiring_token`), and `ShopifyAPI::Auth::RefreshToken.refresh_access_token` still POST the client secret under HTTParty's default redirect policy.
+
+## 16.3.1 (2026-10-22)
+- [#1472](https://github.com/Shopify/shopify-api-ruby/pull/1472) `ShopifyAPI::Auth.embedded_app_url` now raises `ShopifyAPI::Errors::InvalidShopError` unless the decoded `host` is a trusted Shopify Admin host (see `ShopifyAPI::Utils::ShopValidator`). URLs for supported Admin hosts are unchanged.
+- [#1472](https://github.com/Shopify/shopify-api-ruby/pull/1472) `ShopifyAPI::Auth::Oauth.begin_auth` now validates and normalizes `shop` with `ShopifyAPI::Utils::ShopValidator.sanitize!`, and raises `ShopifyAPI::Errors::InvalidShopError` for untrusted domains.
+- [#1472](https://github.com/Shopify/shopify-api-ruby/pull/1472) `ShopifyAPI::Utils::ShopValidator` now rejects hosts with non-hostname characters and reads the store handle from the segment after `/store/` in Admin URLs (`admin.shopify.com/store/<handle>`), rejecting a missing or invalid handle.
+
 ## 16.3.0 (2026-08-04)
 - [#1443](https://github.com/Shopify/shopify-api-ruby/pull/1443) Add `ShopifyAPI::Utils::ShopValidator` with `sanitize_shop_domain` and `sanitize!`.
 - [#1443](https://github.com/Shopify/shopify-api-ruby/pull/1443) Derive the target shop for `ShopifyAPI::Auth::TokenExchange.exchange_token` from the session token's `dest` claim. The `shop` argument is now deprecated and will be removed in the next major version.

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    shopify_api (16.3.0)
+    shopify_api (16.4.0)
       activesupport
       addressable (~> 2.7)
       concurrent-ruby

data/docs/usage/oauth.md

@@ -277,18 +277,29 @@ end
 ### Client Credentials Grant
 
 > [!NOTE]
-> You can only use the client credentials grant when building apps for your own organization.
+> Existing client-secret eligibility rules are unchanged. Assertion authentication also supports eligible
+> public apps with a registered public key and an existing installation on the target shop, when the
+> Shopify token endpoint supports this authentication method.
 
 > [!WARNING]
 > [token exchange](#token-exchange) (for embedded apps) or the [authorization code grant](#authorization-code-grant) should be used instead of the client credentials grant, if your app is a browser based web app.
 
 #### Perform Client Credentials Grant
 Use [`ShopifyAPI::Auth::ClientCredentials`](https://github.com/Shopify/shopify-api-ruby/blob/main/lib/shopify_api/auth/client_credentials.rb) to
-exchange the [app's client ID and client secret](https://shopify.dev/docs/apps/build/authentication-authorization/client-secrets) for an access token.
+obtain an application-only access token using the [app's client ID and client secret](https://shopify.dev/docs/apps/build/authentication-authorization/client-secrets),
+or a [signed client assertion](#client-assertion-authentication).
+
+Client-credentials requests do not follow HTTP redirects, with either authentication method. A redirect
+raises `ShopifyAPI::Errors::HttpResponseError`; no request is sent to its target. This prevents a 307/308
+from forwarding the credential-bearing POST body. This intentionally changes the previous secret-path
+behavior, including when global HTTParty defaults enable redirects. Explicit routing and connection
+settings remain supported, and other operations keep their redirect policy.
+
 #### Input
 | Parameter      | Type                   | Required? | Default Value | Notes                                                                                                       |
 | -------------- | ---------------------- | :-------: | :-----------: | ----------------------------------------------------------------------------------------------------------- |
 | `shop`         | `String` | Yes | - | A Shopify domain name in the form `{exampleshop}.myshopify.com`. |
+| `client_assertion` | `String` | No | `nil` | A signed JWT client assertion. When omitted or `nil`, the grant authenticates with the app's client secret as before. Leading or trailing whitespace is rejected rather than trimmed. See [Client Assertion Authentication](#client-assertion-authentication). |
 
 #### Output
 This method returns the new `ShopifyAPI::Auth::Session` object from the client credentials grant, your app should store this `Session` object to be used later [when making authenticated API calls](#using-oauth-session-to-make-authenticated-api-calls).
@@ -307,6 +318,119 @@ end
 
 ```
 
+### Client Assertion Authentication
+
+Instead of the app's client secret, the client credentials grant can authenticate with a short-lived JWT
+client assertion signed by a private key your app owns. Pass the assertion as `client_assertion:`; the
+request then sends only `client_id`, `grant_type`, `client_assertion_type` and `client_assertion`, and no
+client secret.
+
+To generate a key pair, register its public key with your app and see the claims Shopify expects, read
+[Get application-only access tokens](https://shopify.dev/docs/apps/build/authentication-authorization/application-only-access-tokens).
+
+> [!IMPORTANT]
+> An assertion is **single use**. Every token request — including every retry after a failure — needs a
+> newly created assertion, because a second use of the same assertion is refused. This library makes one
+> HTTP attempt per call and does not follow redirects on the assertion request, so a consumed assertion is
+> never replayed on your behalf.
+
+The assertion request uses the same HTTP transport as other requests. For this call only, it sends
+`basic_auth` and `digest_auth` as `nil`, so inherited Basic or digest credentials are never attached and
+HTTParty cannot replay the single-use assertion against a digest challenge. Global HTTParty defaults are
+not modified, connection settings such as proxy, CA, and timeout configuration remain in effect, and so do
+non-credential headers. Requests without an assertion keep their authentication and connection settings,
+but follow the same no-redirect policy.
+
+The request also fails before I/O with `ShopifyAPI::Errors::InvalidHttpRequestError` if
+`ShopifyAPI::Context.api_host` contains URL userinfo (`user:password@host`). HTTParty rebuilds Basic
+credentials from the URL after the `nil` override, so those credentials would otherwise be sent.
+
+Everything else in global HTTParty state is yours to control, and this library neither inspects nor changes
+it. Two cases are worth calling out: a `logger` with `log_format: :curl` writes `request.raw_body`, and
+therefore the assertion, into your application log; and default headers such as `Cookie` or
+`Proxy-Authorization`, along with `HTTParty.cookies`, are attached to this request like any other. Custom
+connection adapters and diagnostic logging must not add OAuth credentials, replay the assertion, or log it.
+
+Your app owns the key pair. This library never generates, imports, stores, or rotates keys, and never reads
+a key from `ShopifyAPI::Context`. Register the matching public key with Shopify and pass its key ID as
+`kid`. Omitting `client_assertion` keeps the existing client-secret behavior, and a blank or non-`String`
+value raises `ShopifyAPI::Errors::InvalidClientAssertionError` rather than silently falling back to the
+secret.
+
+> [!IMPORTANT]
+> **You must supply the target shop's permanent domain.** The helper normalizes case and surrounding
+> whitespace only; it does not look up the permanent domain or verify the shop's identity. Every domain that
+> is not a `myshopify.com` domain is rejected, including custom storefront domains and the development
+> domains `ShopifyAPI::Utils::ShopValidator` trusts. A valid
+> `myshopify.com` domain is used as supplied, so you must select the correct shop and use the same canonical
+> domain when exchanging the assertion.
+
+#### Creating an assertion
+
+[`ShopifyAPI::Auth::ClientAssertion.create`](https://github.com/Shopify/shopify-api-ruby/blob/main/lib/shopify_api/auth/client_assertion.rb)
+is an optional helper that signs an assertion with a key your app already holds in memory. It modifies
+nothing, needs no client secret, and the only value it reads from `ShopifyAPI::Context` is `api_key`, as the
+default for `client_id`.
+
+| Parameter | Type | Required? | Default Value | Notes |
+| --------- | ---- | :-------: | :-----------: | ----- |
+| `shop` | `String` | Yes | - | The shop's permanent `{shop}.myshopify.com` domain, which becomes the assertion's `aud`. Only case and surrounding whitespace are normalized; a bare shop handle, a full URL, an `admin.shopify.com/store/{shop}` URL, and anything that is not a `myshopify.com` domain are all rejected. Not used when `audience` is supplied. |
+| `client_id` | `String` | No | `ShopifyAPI::Context.api_key` | Your app's client ID. Becomes both `iss` and `sub`, which Shopify requires to match the `client_id` the token request sends — so the default is normally the right value. |
+| `kid` | `String` | Yes | - | The key ID of the registered public key. Surrounding whitespace is trimmed, and a `kid` longer than 255 characters is rejected, since Shopify cannot store one. |
+| `private_key` | `OpenSSL::PKey::RSA` or `OpenSSL::PKey::EC` | Yes | - | A private key object. RSA keys must be at least 2048 bits (`RS256`); EC keys must use the P-256 curve (`ES256`). Anything else is rejected. |
+| `lifetime_seconds` | `Integer` | No | `60` | Must be between 1 and 300. Out-of-range values are rejected, not clamped. |
+| `audience` | `String` | No | `nil` | Sets the `aud` claim directly and skips all `shop` validation. For development environments only, where the shop's permanent domain is not a `myshopify.com` domain; you are responsible for the value. |
+
+```ruby
+# `private_key` is an OpenSSL::PKey::RSA or OpenSSL::PKey::EC private key your app loaded itself.
+def authenticate_with_assertion(shop, private_key)
+  assertion = ShopifyAPI::Auth::ClientAssertion.create(
+    shop: shop,
+    kid: "my-registered-key-id",
+    private_key: private_key,
+  )
+
+  session = ShopifyAPI::Auth::ClientCredentials.client_credentials(
+    shop: shop,
+    client_assertion: assertion,
+  )
+  SessionRepository.store_session(session)
+end
+```
+
+The algorithm is derived from the key, and the claims (`iss`, `sub`, `aud`, `iat`, `exp`, and a fresh `jti`
+per call) are built by the library. Supplying your own claims, headers, or algorithm is not supported. If
+you sign elsewhere — with a KMS or HSM, for example — skip this helper and pass the finished assertion
+string straight to `client_credentials`.
+
+Keep the signing host's clock synchronized. Shopify checks `iat` and `exp` against its own clock, so a host
+whose clock is off can sign assertions that are rejected. If the clock may drift, raise `lifetime_seconds`
+toward 300.
+
+Pass the full `{shop}.myshopify.com` domain to both calls, as the example above does. The signer and
+`client_credentials` accept the same canonical domain, so one value works for both.
+
+A development store whose permanent domain is not a `myshopify.com` domain is rejected by the signer. Pass
+`audience:` in that case, built as
+`https://{permanent domain}/admin/oauth/access_token`, and keep it out of production code paths.
+
+Your app still needs its real client secret configured: `ShopifyAPI::Context.setup` requires
+`api_secret_key`, and other parts of this library use it, such as webhook HMAC and session-token
+verification. On the assertion path it is never read, never sent, and never used.
+
+#### Troubleshooting
+
+A `401 invalid_client` response means the assertion was rejected. The response doesn't say why, so check
+that:
+
+- the `kid` names an active key registered for this app
+- the assertion was signed with that key's private key
+- `aud` is `https://{the shop's permanent domain}/admin/oauth/access_token`
+- `iss` and `sub` are the `client_id` the request sends
+- the assertion is new: each one can only be used once
+
+A `5xx` response is temporary. Sign a new assertion before you retry.
+
 ## Expiring Offline Access Tokens
 
 

data/lib/shopify_api/auth/client_assertion.rb

@@ -0,0 +1,157 @@
+# typed: strict
+# frozen_string_literal: true
+
+module ShopifyAPI
+  module Auth
+    module ClientAssertion
+      extend T::Sig
+
+      DEFAULT_LIFETIME_SECONDS = 60
+      # Mirrors Shopify's own bound: an assertion whose `exp - iat` is more than 5 minutes is rejected, and
+      # exactly 300 seconds is accepted. Check this value against
+      # https://shopify.dev/docs/apps/build/authentication-authorization/application-only-access-tokens
+      # before changing it.
+      MAX_LIFETIME_SECONDS = 300
+      RSA_ALGORITHM = "RS256"
+      EC_ALGORITHM = "ES256"
+      MIN_RSA_KEY_BITS = 2048
+      # Shopify accepts a `kid` of at most 255 characters, so a longer one can never match.
+      MAX_KID_LENGTH = 255
+      SUPPORTED_EC_CURVES = T.let(["prime256v1", "secp256r1"].freeze, T::Array[String])
+      PERMANENT_SHOP_DOMAIN = /\A[a-z0-9][a-z0-9_-]*\.myshopify\.com\z/
+      MYSHOPIFY_DOMAIN = "myshopify.com"
+
+      class << self
+        extend T::Sig
+
+        sig do
+          params(
+            shop: String,
+            kid: String,
+            private_key: T.any(OpenSSL::PKey::RSA, OpenSSL::PKey::EC),
+            client_id: T.nilable(String),
+            lifetime_seconds: Integer,
+            audience: T.nilable(String),
+          ).returns(String)
+        end
+        def create(
+          shop:,
+          kid:,
+          private_key:,
+          client_id: nil,
+          lifetime_seconds: DEFAULT_LIFETIME_SECONDS,
+          audience: nil
+        )
+          audience = audience.nil? ? audience_for(shop) : validated_audience(audience)
+          # The only value read from `ShopifyAPI::Context`, and only when the caller omits it. The server
+          # requires `iss` and `sub` to equal the `client_id` the request posts, which is `Context.api_key`.
+          client_id = Context.api_key if client_id.nil?
+          client_id = validated_value(client_id, "client_id")
+          kid = validated_kid(kid)
+          validate_lifetime!(lifetime_seconds)
+          signing_key, algorithm = validated_key_with_algorithm(private_key)
+
+          issued_at = Time.now.to_i
+          claims = {
+            "iss" => client_id,
+            "sub" => client_id,
+            "aud" => audience,
+            "iat" => issued_at,
+            "exp" => issued_at + lifetime_seconds,
+            "jti" => SecureRandom.uuid,
+          }
+
+          JWT.encode(claims, signing_key, algorithm, { "kid" => kid, "typ" => "JWT" })
+        end
+
+        private
+
+        # Only the shop's canonical permanent domain is accepted, so that the signer and
+        # `ClientCredentials.client_credentials` agree on what a shop is. Case is normalized with ASCII
+        # folding only: Unicode folding maps characters such as U+212A KELVIN SIGN onto ASCII letters, which
+        # would turn one shop's name into another real shop's audience.
+        sig { params(shop: String).returns(String) }
+        def audience_for(shop)
+          host = shop.strip.tr("A-Z", "a-z")
+          unless PERMANENT_SHOP_DOMAIN.match?(host)
+            raise Errors::InvalidClientAssertionError,
+              "shop must be a permanent #{MYSHOPIFY_DOMAIN} domain in the form " \
+                "{handle}.#{MYSHOPIFY_DOMAIN}, got: #{shop.inspect}"
+          end
+
+          ClientCredentials.token_endpoint_url(host)
+        end
+
+        sig { params(audience: String).returns(String) }
+        def validated_audience(audience)
+          validated_value(audience, "audience")
+        end
+
+        # Trimmed rather than rejected: a value read from a file or pasted from a terminal often carries a
+        # newline, and the server matches `iss` and `kid` exactly, so an untrimmed value can only ever fail.
+        sig { params(value: String, name: String).returns(String) }
+        def validated_value(value, name)
+          trimmed = value.strip
+          raise Errors::InvalidClientAssertionError, "#{name} must be a non-empty String" if trimmed.empty?
+
+          trimmed
+        end
+
+        sig { params(kid: String).returns(String) }
+        def validated_kid(kid)
+          trimmed = validated_value(kid, "kid")
+          if trimmed.length > MAX_KID_LENGTH
+            raise Errors::InvalidClientAssertionError,
+              "kid must be at most #{MAX_KID_LENGTH} characters, got: #{trimmed.length}"
+          end
+
+          trimmed
+        end
+
+        sig { params(lifetime_seconds: Integer).void }
+        def validate_lifetime!(lifetime_seconds)
+          return if lifetime_seconds.positive? && lifetime_seconds <= MAX_LIFETIME_SECONDS
+
+          raise Errors::InvalidClientAssertionError,
+            "lifetime_seconds must be between 1 and #{MAX_LIFETIME_SECONDS}, got: #{lifetime_seconds}"
+        end
+
+        # Takes `Object` so that the checks below still run for an app that has turned sorbet-runtime's
+        # call validation off.
+        sig do
+          params(private_key: Object).returns([T.any(OpenSSL::PKey::RSA, OpenSSL::PKey::EC), String])
+        end
+        def validated_key_with_algorithm(private_key)
+          case private_key
+          when OpenSSL::PKey::RSA
+            unless private_key.private?
+              raise Errors::InvalidClientAssertionError, "private_key must be an RSA private key, not a public key"
+            end
+
+            if private_key.n.num_bits < MIN_RSA_KEY_BITS
+              raise Errors::InvalidClientAssertionError,
+                "RSA private_key must be at least #{MIN_RSA_KEY_BITS} bits, got: #{private_key.n.num_bits}"
+            end
+
+            [private_key, RSA_ALGORITHM]
+          when OpenSSL::PKey::EC
+            unless private_key.private?
+              raise Errors::InvalidClientAssertionError, "private_key must be an EC private key, not a public key"
+            end
+
+            unless SUPPORTED_EC_CURVES.include?(private_key.group.curve_name)
+              raise Errors::InvalidClientAssertionError,
+                "EC private_key must use the P-256 curve, got: #{private_key.group.curve_name}"
+            end
+
+            [private_key, EC_ALGORITHM]
+          else
+            raise Errors::InvalidClientAssertionError,
+              "private_key must be an OpenSSL::PKey::RSA or OpenSSL::PKey::EC private key, " \
+                "got: #{private_key.class}"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/shopify_api/auth/client_credentials.rb

@@ -7,16 +7,31 @@ module ShopifyAPI
       extend T::Sig
 
       CLIENT_CREDENTIALS_GRANT_TYPE = "client_credentials"
+      CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
+      TOKEN_ENDPOINT_BASE_PATH = "/admin/oauth"
+      TOKEN_ENDPOINT_PATH = "access_token"
 
       class << self
         extend T::Sig
 
+        # The URL this grant posts to. `ClientAssertion.create` derives the assertion's `aud` claim from
+        # here rather than spelling the URL out again: Shopify rejects an assertion whose `aud` is not the
+        # endpoint the request arrives at, and reports it as an indistinguishable `invalid_client`.
+        sig { params(shop: String).returns(String) }
+        def token_endpoint_url(shop)
+          "https://#{shop}#{TOKEN_ENDPOINT_BASE_PATH}/#{TOKEN_ENDPOINT_PATH}"
+        end
+
+        # `client_assertion` is typed `T.untyped` so that a wrong type reaches the validation below:
+        # sorbet-runtime's TypeError message embeds the offending argument, and a JWT is short enough that
+        # the truncated message shows a usable part of a live credential.
         sig do
           params(
             shop: String,
+            client_assertion: T.untyped,
           ).returns(ShopifyAPI::Auth::Session)
         end
-        def client_credentials(shop:)
+        def client_credentials(shop:, client_assertion: nil)
           unless ShopifyAPI::Context.setup?
             raise ShopifyAPI::Errors::ContextNotSetupError,
               "ShopifyAPI::Context not setup, please call ShopifyAPI::Context.setup"
@@ -24,20 +39,32 @@ module ShopifyAPI
 
           validated_shop = Utils::ShopValidator.sanitize!(shop)
           shop_session = ShopifyAPI::Auth::Session.new(shop: validated_shop)
-          body = {
-            client_id: ShopifyAPI::Context.api_key,
-            client_secret: ShopifyAPI::Context.api_secret_key,
-            grant_type: CLIENT_CREDENTIALS_GRANT_TYPE,
-          }
+          body = if client_assertion.nil?
+            {
+              client_id: ShopifyAPI::Context.api_key,
+              client_secret: ShopifyAPI::Context.api_secret_key,
+              grant_type: CLIENT_CREDENTIALS_GRANT_TYPE,
+            }
+          else
+            {
+              client_id: ShopifyAPI::Context.api_key,
+              grant_type: CLIENT_CREDENTIALS_GRANT_TYPE,
+              client_assertion_type: CLIENT_ASSERTION_TYPE,
+              client_assertion: validated_assertion(client_assertion),
+            }
+          end
 
-          client = Clients::HttpClient.new(session: shop_session, base_path: "/admin/oauth")
+          client = Clients::HttpClient.new(session: shop_session, base_path: TOKEN_ENDPOINT_BASE_PATH)
           response =
             client.request(
               Clients::HttpRequest.new(
                 http_method: :post,
-                path: "access_token",
+                path: TOKEN_ENDPOINT_PATH,
                 body: body,
                 body_type: "application/json",
+                tries: 1,
+                follow_redirects: false,
+                suppress_inherited_http_auth: !client_assertion.nil?,
               ),
             )
           response_hash = T.cast(response.body, T::Hash[String, T.untyped]).to_h
@@ -47,6 +74,28 @@ module ShopifyAPI
             access_token_response: Oauth::AccessTokenResponse.from_hash(response_hash),
           )
         end
+
+        private
+
+        sig { params(client_assertion: Object).returns(String) }
+        def validated_assertion(client_assertion)
+          unless client_assertion.is_a?(String)
+            raise ShopifyAPI::Errors::InvalidClientAssertionError,
+              "client_assertion must be a String, got: #{client_assertion.class}"
+          end
+          if client_assertion.strip.empty?
+            raise ShopifyAPI::Errors::InvalidClientAssertionError, "client_assertion must not be blank"
+          end
+
+          # Rejected rather than trimmed: a JWT that arrived with whitespace around it means the caller's
+          # plumbing is wrong, and the server compares the assertion byte for byte.
+          unless client_assertion == client_assertion.strip
+            raise ShopifyAPI::Errors::InvalidClientAssertionError,
+              "client_assertion must not have leading or trailing whitespace"
+          end
+
+          client_assertion
+        end
       end
     end
   end

data/lib/shopify_api/auth/oauth.rb

@@ -33,6 +33,8 @@ module ShopifyAPI
           end
           raise Errors::UnsupportedOauthError, "Cannot perform OAuth for private apps." if Context.private?
 
+          shop = Utils::ShopValidator.sanitize!(shop)
+
           state = SecureRandom.alphanumeric(NONCE_LENGTH)
 
           cookie = SessionCookie.new(value: state, expires: Time.now + 60)

data/lib/shopify_api/auth/token_exchange.rb

@@ -73,7 +73,8 @@ module ShopifyAPI
               ),
             )
           rescue ShopifyAPI::Errors::HttpResponseError => error
-            if error.code == 400 && error.response.body["error"] == "invalid_subject_token"
+            if error.code == 400 &&
+                ["invalid_subject_token", "invalid_identity_session"].include?(error.response.body["error"])
               raise ShopifyAPI::Errors::InvalidJwtTokenError, "Session token was rejected by token exchange"
             end
 

data/lib/shopify_api/auth.rb

@@ -1,10 +1,19 @@
 # typed: strict
 # frozen_string_literal: true
 
+require "addressable/uri"
+
 module ShopifyAPI
   module Auth
     extend T::Sig
 
+    # Hostname characters, plus an optional port. Anything else before the first "/" is rejected.
+    EMBEDDED_HOST_AUTHORITY_REGEX = T.let(/\A[a-zA-Z0-9._-]+(:\d{1,5})?\z/, Regexp)
+
+    # Printable ASCII only: no whitespace, control bytes or non-ASCII bytes.
+    EMBEDDED_HOST_ALLOWED_BYTES_REGEX = T.let(/\A[\x21-\x7e]+\z/n, Regexp)
+    private_constant :EMBEDDED_HOST_AUTHORITY_REGEX, :EMBEDDED_HOST_ALLOWED_BYTES_REGEX
+
     class << self
       extend T::Sig
 
@@ -19,8 +28,29 @@ module ShopifyAPI
         end
 
         decoded_host = Base64.decode64(host)
+        unless trusted_embedded_host?(decoded_host)
+          raise Errors::InvalidShopError, "host must decode to a trusted Shopify Admin host"
+        end
+
         "https://#{decoded_host}/apps/#{Context.api_key}"
       end
+
+      private
+
+      sig { params(decoded_host: String).returns(T::Boolean) }
+      def trusted_embedded_host?(decoded_host)
+        return false unless decoded_host.b.match?(EMBEDDED_HOST_ALLOWED_BYTES_REGEX)
+
+        authority = T.must(decoded_host.split("/", 2).first)
+        return false unless authority.match?(EMBEDDED_HOST_AUTHORITY_REGEX)
+
+        uri = Addressable::URI.parse("https://#{decoded_host}")
+        return false unless uri.userinfo.nil? && uri.authority == authority
+
+        !Utils::ShopValidator.sanitize_shop_domain(uri.to_s).nil?
+      rescue Addressable::URI::InvalidURIError
+        false
+      end
     end
   end
 end

data/lib/shopify_api/clients/http_client.rb

@@ -32,11 +32,16 @@ module ShopifyAPI
         end
       end
 
-      sig { params(request: HttpRequest, response_as_struct: T::Boolean).returns(HttpResponse) }
+      sig do
+        params(
+          request: HttpRequest,
+          response_as_struct: T::Boolean,
+        ).returns(HttpResponse)
+      end
       def request(request, response_as_struct: false)
         request.verify
 
-        headers = @headers
+        headers = @headers.dup
         headers["Content-Type"] = T.must(request.body_type) if request.body_type
         headers = headers.merge(T.must(request.extra_headers)) if request.extra_headers
 
@@ -48,14 +53,30 @@ module ShopifyAPI
         response = HttpResponse.new(code: 0, headers: {}, body: "")
         while tries < request.tries
           tries += 1
-          res = T.cast(HTTParty.send(
-            request.http_method,
-            parsed_uri.to_s,
+          request_options = {
             headers: headers,
             query: request.query,
             body: request.body.class == Hash ? T.unsafe(request.body).to_json : request.body,
+          }
+          request_options[:follow_redirects] = request.follow_redirects unless request.follow_redirects.nil?
+
+          if request.suppress_inherited_http_auth
+            verify_no_url_credentials!(parsed_uri)
+            request_options.merge!(basic_auth: nil, digest_auth: nil)
+          end
+
+          res = T.cast(HTTParty.send(
+            request.http_method,
+            parsed_uri.to_s,
+            **request_options,
           ), HTTParty::Response)
 
+          if request.follow_redirects == false && res.code.to_i.between?(300, 399)
+            blocked_response = HttpResponse.new(code: res.code.to_i, headers: res.headers.to_h, body: res.body.to_s)
+            raise ShopifyAPI::Errors::HttpResponseError.new(response: blocked_response),
+              blocked_redirect_message(res)
+          end
+
           begin
             body = res.body.nil? || res.body.empty? ? {} : JSON.parse(res.body)
           rescue JSON::ParserError
@@ -111,9 +132,14 @@ module ShopifyAPI
       sig { params(response: HttpResponse).returns(String) }
       def serialized_error(response)
         body = {}
-        body["errors"] = response.body["errors"] if response.body["errors"]
-        body["error"] = response.body["error"] if response.body["error"]
-        body["error_description"] = response.body["error_description"] if response.body["error"]
+        # Only a parsed JSON object has error members. On an unparsed body `response.body["errors"]` is
+        # `String#[]`, so an HTML page containing the word "errors" would report `{"errors":"errors"}`.
+        if response.body.is_a?(Hash)
+          error_body = T.cast(response.body, T::Hash[String, T.untyped])
+          body["errors"] = error_body["errors"] if error_body["errors"]
+          body["error"] = error_body["error"] if error_body["error"]
+          body["error_description"] = error_body["error_description"] if error_body["error_description"]
+        end
 
         if response.headers["x-request-id"]
           id = T.must(response.headers["x-request-id"])[0]
@@ -124,6 +150,30 @@ module ShopifyAPI
 
       private
 
+      # A redirect on a credential-bearing request is the one error here a developer cannot diagnose from
+      # the status alone, so it says what happened, what was not sent, and what to check.
+      sig { params(res: HTTParty::Response).returns(String) }
+      def blocked_redirect_message(res)
+        location = res.headers["location"]
+        target = location.nil? || location.empty? ? "an unnamed location" : location
+
+        "Refused to follow the #{res.code} redirect to #{target}, because this request was sent with " \
+          "redirects disabled: following it would forward the request body, and any credentials in it, to " \
+          "the redirect target. Nothing was sent there. Check any proxy or ShopifyAPI::Context.api_host " \
+          "configuration in front of the endpoint, and retry with a newly created client assertion if you " \
+          "are using one."
+      end
+
+      # HTTParty's `set_basic_auth_from_uri` rebuilds `basic_auth` from the URL after an explicit `nil`
+      # override, so suppressing inherited authentication is not enough on its own.
+      sig { params(parsed_uri: URI::Generic).void }
+      def verify_no_url_credentials!(parsed_uri)
+        return unless parsed_uri.userinfo
+
+        raise ShopifyAPI::Errors::InvalidHttpRequestError,
+          "Cannot send a request with HTTP authentication disabled to a URL containing credentials."
+      end
+
       sig do
         params(
           headers: T::Hash[T.any(Symbol, String), T.untyped],

data/lib/shopify_api/clients/http_request.rb

@@ -13,6 +13,12 @@ module ShopifyAPI
       prop :query, T.nilable(T::Hash[T.any(Symbol, String), T.untyped])
       prop :extra_headers, T.nilable(T::Hash[T.any(Symbol, String), T.untyped])
       prop :tries, Integer, default: 1
+      # Unset leaves redirect handling to HTTParty, including any policy the app set in default_options.
+      prop :follow_redirects, T.nilable(T::Boolean)
+      # Sends this one request with HTTParty's inherited Basic and digest authentication turned off. Digest
+      # auth matters most: HTTParty replays the whole request on a 401 challenge, which would replay a
+      # single-use credential such as a client assertion.
+      prop :suppress_inherited_http_auth, T::Boolean, default: false
 
       sig { void }
       def verify

data/lib/shopify_api/errors/invalid_client_assertion_error.rb

@@ -0,0 +1,9 @@
+# typed: strict
+# frozen_string_literal: true
+
+module ShopifyAPI
+  module Errors
+    class InvalidClientAssertionError < StandardError
+    end
+  end
+end

data/lib/shopify_api/utils/shop_validator.rb

@@ -17,6 +17,10 @@ module ShopifyAPI
         T::Array[String],
       )
 
+      HOSTNAME_REGEX = T.let(/\A[a-z0-9_-]+(\.[a-z0-9_-]+)*\.?\z/, Regexp)
+      STORE_HANDLE_REGEX = T.let(/\A[a-z0-9][a-z0-9-]*\z/, Regexp)
+      private_constant :HOSTNAME_REGEX, :STORE_HANDLE_REGEX
+
       class << self
         extend T::Sig
 
@@ -29,6 +33,7 @@ module ShopifyAPI
         def sanitize_shop_domain(shop_domain, myshopify_domain: nil)
           uri = uri_from_shop_domain(shop_domain, myshopify_domain)
           return nil if uri.nil? || uri.host.nil? || uri.host.empty?
+          return nil unless T.cast(uri.host, String).match?(HOSTNAME_REGEX)
 
           trusted_domains(myshopify_domain).each do |trusted_domain|
             host = T.cast(uri.host, String)
@@ -107,9 +112,13 @@ module ShopifyAPI
           T.cast(uri.host, String).split(".").first == "admin"
         end
 
-        sig { params(uri: Addressable::URI).returns(String) }
+        sig { params(uri: Addressable::URI).returns(T.nilable(String)) }
         def myshopify_domain_from_unified_admin(uri)
-          shop = uri.path.to_s.split("/").last
+          segments = uri.path.to_s.split("/")
+          store_index = segments.index("store")
+          shop = store_index && segments[store_index + 1]
+          return unless shop&.match?(STORE_HANDLE_REGEX)
+
           "#{shop}.myshopify.com"
         end
       end

data/lib/shopify_api/version.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module ShopifyAPI
-  VERSION = "16.3.0"
+  VERSION = "16.4.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: shopify_api
 version: !ruby/object:Gem::Version
-  version: 16.3.0
+  version: 16.4.0
 platform: ruby
 authors:
 - Shopify
@@ -203,9 +203,6 @@ files:
 - ".github/workflows/build.yml"
 - ".github/workflows/cla.yml"
 - ".github/workflows/close-waiting-for-response-issues.yml"
-- ".github/workflows/gardener-investigate-issue.yml"
-- ".github/workflows/gardener-notify-event.yml"
-- ".github/workflows/gardener-notify-slack.yml"
 - ".github/workflows/remove-labels-on-activity.yml"
 - ".rubocop.yml"
 - ".ruby-version"
@@ -240,6 +237,7 @@ files:
 - lib/shopify_api/auth.rb
 - lib/shopify_api/auth/associated_user.rb
 - lib/shopify_api/auth/auth_scopes.rb
+- lib/shopify_api/auth/client_assertion.rb
 - lib/shopify_api/auth/client_credentials.rb
 - lib/shopify_api/auth/jwt_payload.rb
 - lib/shopify_api/auth/oauth.rb
@@ -262,6 +260,7 @@ files:
 - lib/shopify_api/errors/disabled_resource_error.rb
 - lib/shopify_api/errors/feature_deprecated_error.rb
 - lib/shopify_api/errors/http_response_error.rb
+- lib/shopify_api/errors/invalid_client_assertion_error.rb
 - lib/shopify_api/errors/invalid_graphql_request_error.rb
 - lib/shopify_api/errors/invalid_http_request_error.rb
 - lib/shopify_api/errors/invalid_jwt_token_error.rb
@@ -1703,7 +1702,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.16
+rubygems_version: 4.0.23
 specification_version: 4
 summary: The gem for accessing the Shopify API
 test_files: []

data/.github/workflows/gardener-investigate-issue.yml

@@ -1,226 +0,0 @@
-name: Gardener - Investigate Issue
-# Automatically investigates GitHub issues using Claude Code when the
-# 'devtools-investigate-for-gardener' label is applied. Can also be triggered manually
-# via workflow_dispatch for a specific issue number.
-on:
-  issues:
-    types: [labeled]
-  workflow_dispatch:
-    inputs:
-      issue_number:
-        description: 'Issue number to investigate'
-        required: true
-        type: number
-
-permissions:
-  contents: read
-  issues: read
-  pull-requests: read
-  checks: read
-
-jobs:
-  investigate:
-    if: >-
-      github.event_name == 'workflow_dispatch' ||
-      github.event.label.name == 'devtools-investigate-for-gardener'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Resolve issue number
-        id: issue
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            NUMBER="${{ github.event.inputs.issue_number }}"
-          else
-            NUMBER="${{ github.event.issue.number }}"
-          fi
-          echo "number=$NUMBER" >> "$GITHUB_OUTPUT"
-          echo "url=https://github.com/${{ github.repository }}/issues/$NUMBER" >> "$GITHUB_OUTPUT"
-
-      # Post a starter message so reviewers can follow along while Claude works.
-      # `continue-on-error: true` keeps a Slack outage from blocking the run.
-      # The response `ts` is stashed for the completion step to thread onto.
-      - name: Post investigation start to Slack
-        id: start_slack
-        continue-on-error: true
-        uses: slackapi/slack-github-action@b0fa283ad8fea605de13dc3f449259339835fc52 # v2.1.0
-        with:
-          method: chat.postMessage
-          token: ${{ secrets.SLACK_GARDENER_BOT_TOKEN }}
-          payload: |-
-            {
-              "channel": "${{ vars.GARDENER_SLACK_CHANNEL_ID }}",
-              "text": "Investigation started for issue #${{ steps.issue.outputs.number }}",
-              "blocks": [
-                {
-                  "type": "section",
-                  "text": {
-                    "type": "mrkdwn",
-                    "text": ":mag: *<${{ steps.issue.outputs.url }}|Issue #${{ steps.issue.outputs.number }}>* — investigation starting…\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View run>"
-                  }
-                }
-              ]
-            }
-
-      - name: Investigate issue
-        id: investigate
-        timeout-minutes: 30
-        uses: anthropics/claude-code-action@b47fd721da662d48c5680e154ad16a73ed74d2e0 # v1
-        env:
-          ANTHROPIC_BASE_URL: ${{ secrets.ANTHROPIC_BASE_URL }}
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          allowed_tools: "Bash(gh issue view *),Bash(gh issue list *),Bash(gh pr list *),Bash(gh pr view *),Bash(gh pr checks *),Bash(gh pr diff *),Bash(gh release list *),Bash(git log *),Bash(git tag -l*),Bash(git show *),Read,Glob,Grep"
-          prompt: |
-            This is a GitHub Actions report-only investigation run.
-
-            /investigating-github-issues ${{ steps.issue.outputs.url }}
-
-            If the skill above did not load, read and follow `.claude/skills/investigating-github-issues/SKILL.md`.
-
-            Do not modify files, create branches, commit, push, or open pull requests.
-            Always return an investigation report as the `report` field in your structured output.
-            If you identify a straightforward fix, describe the proposed fix in the report instead of implementing it.
-          claude_args: |
-            --json-schema '{"type":"object","properties":{"report":{"type":"string","description":"The full investigation report markdown"}},"required":["report"]}'
-
-      - name: Write report to job summary
-        if: always() && steps.investigate.outputs.structured_output
-        env:
-          STRUCTURED_OUTPUT: ${{ steps.investigate.outputs.structured_output }}
-        run: |
-          echo "$STRUCTURED_OUTPUT" | jq -r '.report' >> "$GITHUB_STEP_SUMMARY"
-
-      # Build a single Slack payload — success shape when Claude returned
-      # structured output, failure shape otherwise (crash, timeout, cancel,
-      # or no structured_output). Running in github-script so we can parse
-      # the starter response to thread onto it, and use JSON.stringify to
-      # dodge shell-escaping hazards. The report is Claude's trusted
-      # structured output, so no HTML-escape pass.
-      - name: Prepare Slack payload
-        id: slack_payload
-        if: always()
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
-        env:
-          STRUCTURED_OUTPUT: ${{ steps.investigate.outputs.structured_output }}
-          START_RESPONSE: ${{ steps.start_slack.outputs.response }}
-          CHANNEL_ID: ${{ vars.GARDENER_SLACK_CHANNEL_ID }}
-          ISSUE_NUMBER: ${{ steps.issue.outputs.number }}
-          ISSUE_URL: ${{ steps.issue.outputs.url }}
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-          INVESTIGATE_OUTCOME: ${{ steps.investigate.outcome }}
-        with:
-          result-encoding: string
-          script: |
-            const num = process.env.ISSUE_NUMBER;
-            const url = process.env.ISSUE_URL;
-            const runUrl = process.env.RUN_URL;
-
-            // Thread onto the starter post when it succeeded; otherwise
-            // the result still posts standalone to the channel.
-            let threadTs = null;
-            try {
-              const r = JSON.parse(process.env.START_RESPONSE || '{}');
-              if (r.ok && r.ts) threadTs = r.ts;
-            } catch (_) {}
-
-            let text, blocks;
-
-            // Gate on STRUCTURED_OUTPUT (not report content) so the
-            // empty-report edge case still goes through the success path,
-            // matching the previous two-step behavior. Wrapped in try/catch
-            // so a malformed payload falls through to the failure notice
-            // instead of leaving the starter message orphaned.
-            let builtSuccess = false;
-            if (process.env.STRUCTURED_OUTPUT) {
-              try {
-                const structured = JSON.parse(process.env.STRUCTURED_OUTPUT);
-                const report = structured.report || '';
-
-                // Top-sections slice: keep everything up to and including
-                // the Summary section, drop sections that follow it. Falls
-                // back to the full report if the template no longer contains
-                // "## Summary".
-                const lines = report.split('\n');
-                const slice = [];
-                let sawSummary = false;
-                for (const line of lines) {
-                  if (sawSummary && /^## /.test(line)) break;
-                  slice.push(line);
-                  if (/^## Summary/.test(line)) sawSummary = true;
-                }
-                // Stash fenced code blocks so their contents don't get
-                // rewritten by the header/bullet passes below.
-                const codeBlocks = [];
-                let slackReport = (slice.join('\n').trim() || report)
-                  .replace(/^```[^\n]*\n([\s\S]*?)\n```$/gm, (_m, c) => {
-                    codeBlocks.push(c);
-                    return `\x04${codeBlocks.length - 1}\x05`;
-                  })
-                  .replace(/^#{1,6}\s+(.+)$/gm, '*$1*')
-                  .replace(/\*\*(.+?)\*\*/g, '*$1*')
-                  .replace(/\[([^\]]+)\]\(([^)]+)\)/g, '<$2|$1>')
-                  .replace(/^(\s*)- \[x\]\s+/gm, '$1✓ ')
-                  .replace(/^(\s*)[-*]\s+/gm, '$1• ')
-                  .replace(/\x04(\d+)\x05/g, (_m, i) => '```\n' + codeBlocks[+i] + '\n```');
-
-                // Slack section blocks cap at 3000 chars; leave headroom for the footer.
-                const footer = `\n\n<${runUrl}|View full report>`;
-                const MAX = 2900;
-                if (slackReport.length + footer.length > MAX) {
-                  slackReport = slackReport.slice(0, MAX - footer.length - 1) + '…';
-                }
-                slackReport += footer;
-
-                text = `Investigation report for issue #${num}`;
-                blocks = [
-                  { type: 'section',
-                    text: { type: 'mrkdwn',
-                            text: `*<${url}|Issue #${num}>* — Investigation Report` } },
-                  { type: 'divider' },
-                  { type: 'section',
-                    text: { type: 'mrkdwn', text: slackReport } }
-                ];
-                builtSuccess = true;
-              } catch (e) {
-                core.warning(`Failed to build success payload: ${e}; posting failure notice`);
-              }
-            }
-
-            if (!builtSuccess) {
-              const outcome = process.env.INVESTIGATE_OUTCOME;
-              // Outcome = 'success' + no structured output means Claude
-              // returned without a structured report — distinct from an
-              // outright failure.
-              const reason = outcome === 'success'
-                ? 'completed without a report'
-                : `${outcome || 'did not complete'}`;
-              text = `Investigation failed for issue #${num}`;
-              blocks = [
-                { type: 'section',
-                  text: { type: 'mrkdwn',
-                          text: `:x: *<${url}|Issue #${num}>* — investigation ${reason}. <${runUrl}|View run>` } }
-              ];
-            }
-
-            const payload = { channel: process.env.CHANNEL_ID, text, blocks };
-            if (threadTs) {
-              payload.thread_ts = threadTs;
-              // Broadcasts the threaded reply back to the channel so the
-              // summary shows up inline, not only for thread subscribers.
-              payload.reply_broadcast = true;
-            }
-            return JSON.stringify(payload);
-
-      - name: Post to Slack
-        if: always() && steps.slack_payload.outputs.result
-        uses: slackapi/slack-github-action@b0fa283ad8fea605de13dc3f449259339835fc52 # v2.1.0
-        with:
-          method: chat.postMessage
-          token: ${{ secrets.SLACK_GARDENER_BOT_TOKEN }}
-          payload: '${{ steps.slack_payload.outputs.result }}'

data/.github/workflows/gardener-notify-event.yml

@@ -1,35 +0,0 @@
-name: Gardener - Notify Event
-# Tiny event capturer: stashes the triggering issue/PR payload as an artifact
-# for `gardener-notify-slack.yml` to pick up via workflow_run.
-#
-# Why two workflows? When Dependabot triggers a workflow, GitHub forces
-# GITHUB_TOKEN to read-only and hides Actions secrets — so labeling and
-# Slack posting from this workflow would fail on every Dependabot PR. A
-# workflow_run-triggered follow-up runs in the default-branch context with
-# full permissions and secret access, regardless of the upstream actor.
-#
-# Uses pull_request_target so fork-opened PRs still produce an artifact.
-# No code is checked out here; this workflow only reads the pre-parsed
-# event payload, so there is no pwn-request surface.
-on:
-  issues:
-    types: [opened, labeled]
-  pull_request_target:
-    types: [opened, labeled]
-
-permissions:
-  contents: read
-
-jobs:
-  capture:
-    if: github.event.action == 'opened' || github.event.label.name == 'devtools-gardener'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Stash event payload
-        run: cp "$GITHUB_EVENT_PATH" event.json
-
-      - uses: actions/upload-artifact@v4
-        with:
-          name: gardener-event
-          path: event.json
-          retention-days: 1

data/.github/workflows/gardener-notify-slack.yml

@@ -1,116 +0,0 @@
-name: Gardener - Notify Slack
-# Runs after `Gardener - Notify Event` completes and does the real work:
-# applies the devtools-gardener label and posts a summary to Slack.
-#
-# The workflow_run trigger runs this job in the default-branch context with
-# full GITHUB_TOKEN permissions and Actions secret access — this is what
-# lets it succeed for Dependabot-opened PRs, where the upstream event
-# workflow can't label or reach secrets directly.
-on:
-  workflow_run:
-    workflows: ['Gardener - Notify Event']
-    types: [completed]
-
-permissions:
-  contents: read
-  issues: write
-  pull-requests: write
-  actions: read
-
-jobs:
-  notify:
-    # `conclusion == success` also covers runs where the capture job was
-    # skipped by its `if` gate (no matching label, etc.) — in that case
-    # no artifact was uploaded, so the download step below no-ops.
-    if: github.event.workflow_run.conclusion == 'success'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Download event payload
-        id: download
-        continue-on-error: true
-        uses: actions/download-artifact@v4
-        with:
-          name: gardener-event
-          run-id: ${{ github.event.workflow_run.id }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Add devtools-gardener label
-        if: steps.download.outcome == 'success'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
-        run: |
-          ACTION=$(jq -r '.action' event.json)
-          # On `labeled` events the label is already there — skip.
-          if [ "$ACTION" != "opened" ]; then
-            exit 0
-          fi
-          NUMBER=$(jq -r '(.issue // .pull_request).number' event.json)
-          if jq -e 'has("pull_request")' event.json > /dev/null; then
-            gh pr edit "$NUMBER" --add-label devtools-gardener
-          else
-            gh issue edit "$NUMBER" --add-label devtools-gardener
-          fi
-
-      - name: Post to Slack
-        if: steps.download.outcome == 'success'
-        continue-on-error: true
-        env:
-          SLACK_BOT_TOKEN: ${{ secrets.SLACK_GARDENER_BOT_TOKEN }}
-          SLACK_CHANNEL_ID: ${{ vars.GARDENER_SLACK_CHANNEL_ID }}
-        run: |
-          KIND=$(jq -r 'if has("pull_request") then "PR" else "Issue" end' event.json)
-          # Pull the body out, truncate, then convert GitHub Markdown to
-          # Slack mrkdwn. Links and fenced code blocks are stashed before
-          # the HTML-escape pass so their contents survive verbatim (a `&`
-          # inside a URL must stay raw, and code content shouldn't be
-          # mangled). Blockquote `> ` markers are also stashed so the
-          # `>` → `>` escape doesn't break them. Everything else is
-          # HTML-escaped so user-supplied `<`, `>`, `&` can't collide
-          # with Slack link syntax or injected mentions like <!channel>.
-          BODY=$(jq -r '(.issue // .pull_request).body // ""' event.json)
-          if [ ${#BODY} -gt 1000 ]; then
-            BODY="${BODY:0:1000}…"
-          fi
-          BODY=$(printf '%s' "$BODY" | perl -0777 -pe '
-            my @u;
-            s{\[([^\]]+)\]\(([^)]+)\)}{push @u, $2; "\x01$#u\x02$1\x03"}ge;
-            my @c;
-            s{^```[^\n]*\n(.*?)\n```$}{push @c, $1; "\x04$#c\x05"}gems;
-            s/^> /\x06/gm;
-            s/^#{1,6}\s+(.+)$/*$1*/gm;
-            s/\*\*(.+?)\*\*/*$1*/g;
-            s/^(\s*)- \[x\]\s+/$1✓ /gm;
-            s/^(\s*)[-*]\s+/$1• /gm;
-            s/&/&amp;/g;
-            s/</&lt;/g;
-            s/>/&gt;/g;
-            s/\x06/> /g;
-            s{\x01(\d+)\x02(.*?)\x03}{"<$u[$1]|$2>"}ge;
-            s{\x04(\d+)\x05}{"```\n$c[$1]\n```"}ge;
-          ')
-          jq \
-            --arg channel "$SLACK_CHANNEL_ID" \
-            --arg kind "$KIND" \
-            --arg body "$BODY" \
-            '
-              def escape: gsub("&";"&amp;") | gsub("<";"&lt;") | gsub(">";"&gt;");
-
-              (.issue // .pull_request) as $i
-              | ([$i.labels[]?.name | select(. != "devtools-gardener")]
-                  | map("`\(.)`") | join(" ")) as $labels
-              | (if $kind == "PR"
-                  then " · \($i.changed_files) files, +\($i.additions)/-\($i.deletions)"
-                       + (if $i.draft then " · draft" else "" end)
-                  else "" end) as $meta
-              | [ "*<\($i.html_url)|\($kind) #\($i.number)>* — \(($i.title | escape))",
-                  "_opened by \($i.user.login)\($meta)_" ]
-                + (if $body != "" then [$body] else [] end)
-                + (if $labels != "" then [$labels] else [] end)
-              | join("\n") as $msg
-              | { channel: $channel, text: "\($kind) #\($i.number): \($i.title)",
-                  blocks: [{ type: "section", text: { type: "mrkdwn", text: $msg } }] }
-            ' event.json | curl -sf -X POST \
-              -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
-              -H 'Content-type: application/json; charset=utf-8' \
-              -d @- https://slack.com/api/chat.postMessage