Skip to content

Commit 655eb39

Browse files
kvapskvaps
authored
ci(pull-requests): replace GH_PAT with cozystack-ci GitHub App token (#2383)
## Summary - Replace `GH_PAT` (cozystack-bot PAT) with `cozystack-ci` GitHub App token in `pull-requests.yaml` - This was missed in #2351 and broke the `resolve_assets` / `e2e` jobs for release PRs (draft releases not visible with invalid token) ## Test plan - [ ] Re-run the release PR pipeline for `release-1.1.6` and verify `resolve_assets` job passes <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated continuous integration authentication mechanism to use GitHub App tokens instead of personal access tokens. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2 parents 1436fee + 1144211 commit 655eb39

1 file changed

Lines changed: 20 additions & 3 deletions

File tree

‎.github/workflows/pull-requests.yaml‎

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,14 @@ jobs:
9999
disk_id: ${{ steps.fetch_assets.outputs.disk_id }}
100100

101101
steps:
102+
- name: Generate GitHub App token
103+
id: app-token
104+
uses: actions/create-github-app-token@v1
105+
with:
106+
app-id: ${{ secrets.COZYSTACK_CI_APP_ID }}
107+
private-key: ${{ secrets.COZYSTACK_CI_PRIVATE_KEY }}
108+
owner: cozystack
109+
102110
- name: Checkout code
103111
if: contains(github.event.pull_request.labels.*.name, 'release')
104112
uses: actions/checkout@v4
@@ -125,7 +133,7 @@ jobs:
125133
id: fetch_assets
126134
uses: actions/github-script@v7
127135
with:
128-
github-token: ${{ secrets.GH_PAT }}
136+
github-token: ${{ steps.app-token.outputs.token }}
129137
script: |
130138
const tag = '${{ steps.get_tag.outputs.tag }}';
131139
const releases = await github.rest.repos.listReleases({
@@ -159,6 +167,15 @@ jobs:
159167
if: ${{ always() && (needs.build.result == 'success' || needs.resolve_assets.result == 'success') }}
160168

161169
steps:
170+
- name: Generate GitHub App token
171+
if: contains(github.event.pull_request.labels.*.name, 'release')
172+
id: app-token
173+
uses: actions/create-github-app-token@v1
174+
with:
175+
app-id: ${{ secrets.COZYSTACK_CI_APP_ID }}
176+
private-key: ${{ secrets.COZYSTACK_CI_PRIVATE_KEY }}
177+
owner: cozystack
178+
162179
# ▸ Checkout and prepare the codebase
163180
- name: Checkout code
164181
uses: actions/checkout@v4
@@ -188,11 +205,11 @@ jobs:
188205
if: contains(github.event.pull_request.labels.*.name, 'release')
189206
run: |
190207
mkdir -p _out/assets
191-
curl -sSL -H "Authorization: token ${GH_PAT}" -H "Accept: application/octet-stream" \
208+
curl -sSL -H "Authorization: token ${APP_TOKEN}" -H "Accept: application/octet-stream" \
192209
-o _out/assets/nocloud-amd64.raw.xz \
193210
"https://api.github.com/repos/${GITHUB_REPOSITORY}/releases/assets/${{ needs.resolve_assets.outputs.disk_id }}"
194211
env:
195-
GH_PAT: ${{ secrets.GH_PAT }}
212+
APP_TOKEN: ${{ steps.app-token.outputs.token }}
196213

197214
- name: Set sandbox ID
198215
run: echo "SANDBOX_NAME=cozy-e2e-sandbox-$(echo "${GITHUB_REPOSITORY}:${GITHUB_WORKFLOW}:${GITHUB_REF}" | sha256sum | cut -c1-10)" >> $GITHUB_ENV

0 commit comments

Comments
 (0)