Skip to content

Commit dcda5de

Browse files
marc0olomarc0olo
committed
fix(sync-workflow): use pr-automation-bot-public app token instead of GITHUB_TOKEN
GITHUB_TOKEN with contents:write + pull-requests:write is blocked on public dfinity repos (see dfinity/developer-docs#196). Switch both jobs to the pr-automation-bot-public GitHub App token. - Remove elevated permissions blocks from both jobs - Add Create GitHub App Token step (actions/create-github-app-token v3) - Replace secrets.GITHUB_TOKEN with steps.app-token.outputs.token - Move curl auth to GH_TOKEN env var (avoids inline token interpolation) - Update git committer name to pr-automation-bot-public[bot]
1 parent 143393f commit dcda5de

1 file changed

Lines changed: 30 additions & 19 deletions

File tree

‎.github/workflows/sync-upstream.yml‎

Lines changed: 30 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -9,20 +9,24 @@ jobs:
99
check-motoko:
1010
name: Check caffeinelabs/motoko
1111
runs-on: ubuntu-latest
12-
permissions:
13-
contents: write
14-
pull-requests: write
1512

1613
steps:
1714
- uses: actions/checkout@v4
1815

16+
- name: Create GitHub App Token
17+
uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3
18+
id: app-token
19+
with:
20+
app-id: ${{ vars.PR_AUTOMATION_BOT_PUBLIC_APP_ID }}
21+
private-key: ${{ secrets.PR_AUTOMATION_BOT_PUBLIC_PRIVATE_KEY }}
22+
1923
- name: Get latest motoko release tag
2024
id: latest
2125
run: |
2226
TAG=$(gh release view --repo caffeinelabs/motoko --json tagName -q .tagName)
2327
echo "tag=$TAG" >> $GITHUB_OUTPUT
2428
env:
25-
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
29+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
2630

2731
- name: Get current pinned tag
2832
id: current
@@ -54,18 +58,20 @@ jobs:
5458
run: |
5559
TAG="${{ steps.latest.outputs.tag }}"
5660
RESULT=$(curl -sf "https://api.github.com/repos/caffeinelabs/motoko/git/ref/tags/${TAG}" \
57-
-H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" | \
61+
-H "Authorization: Bearer $GH_TOKEN" | \
5862
python3 -c "import sys,json; d=json.load(sys.stdin); print(d['object']['sha'], d['object']['type'])")
5963
OBJ_SHA=$(echo "$RESULT" | awk '{print $1}')
6064
OBJ_TYPE=$(echo "$RESULT" | awk '{print $2}')
6165
if [ "$OBJ_TYPE" = "tag" ]; then
6266
COMMIT=$(curl -sf "https://api.github.com/repos/caffeinelabs/motoko/git/tags/${OBJ_SHA}" \
63-
-H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" | \
67+
-H "Authorization: Bearer $GH_TOKEN" | \
6468
python3 -c "import sys,json; print(json.load(sys.stdin)['object']['sha'])")
6569
else
6670
COMMIT="$OBJ_SHA"
6771
fi
6872
echo "commit=$COMMIT" >> $GITHUB_OUTPUT
73+
env:
74+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
6975

7076
- name: Fetch upstream files and build diff
7177
if: steps.check.outputs.needed == 'true'
@@ -116,39 +122,42 @@ jobs:
116122
fi
117123
done
118124
119-
120125
- name: Create sync PR
121126
if: steps.check.outputs.needed == 'true'
122127
run: |
123128
BRANCH="${{ steps.check.outputs.branch }}"
124-
git config user.name "github-actions[bot]"
125-
git config user.email "github-actions[bot]@users.noreply.github.com"
129+
git config user.name "pr-automation-bot-public[bot]"
130+
git config user.email "pr-automation-bot-public[bot]@users.noreply.github.com"
126131
git checkout -b "$BRANCH"
127132
git commit --allow-empty -m "chore: upstream sync check — caffeinelabs/motoko ${{ steps.latest.outputs.tag }}"
128133
git push -u origin "$BRANCH"
129134
gh pr create \
130135
--title "chore: sync check — caffeinelabs/motoko ${{ steps.latest.outputs.tag }}" \
131136
--body-file /tmp/pr-body.md
132137
env:
133-
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
138+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
134139

135140
check-mops:
136141
name: Check caffeinelabs/mops
137142
runs-on: ubuntu-latest
138-
permissions:
139-
contents: write
140-
pull-requests: write
141143

142144
steps:
143145
- uses: actions/checkout@v4
144146

147+
- name: Create GitHub App Token
148+
uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3
149+
id: app-token
150+
with:
151+
app-id: ${{ vars.PR_AUTOMATION_BOT_PUBLIC_APP_ID }}
152+
private-key: ${{ secrets.PR_AUTOMATION_BOT_PUBLIC_PRIVATE_KEY }}
153+
145154
- name: Get latest mops release tag
146155
id: latest
147156
run: |
148157
TAG=$(gh release list --repo caffeinelabs/mops --limit 100 --json tagName --jq '[.[] | select(.tagName | startswith("cli-"))] | first | .tagName')
149158
echo "tag=$TAG" >> $GITHUB_OUTPUT
150159
env:
151-
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
160+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
152161

153162
- name: Get current pinned tag
154163
id: current
@@ -180,18 +189,20 @@ jobs:
180189
run: |
181190
TAG="${{ steps.latest.outputs.tag }}"
182191
RESULT=$(curl -sf "https://api.github.com/repos/caffeinelabs/mops/git/ref/tags/${TAG}" \
183-
-H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" | \
192+
-H "Authorization: Bearer $GH_TOKEN" | \
184193
python3 -c "import sys,json; d=json.load(sys.stdin); print(d['object']['sha'], d['object']['type'])")
185194
OBJ_SHA=$(echo "$RESULT" | awk '{print $1}')
186195
OBJ_TYPE=$(echo "$RESULT" | awk '{print $2}')
187196
if [ "$OBJ_TYPE" = "tag" ]; then
188197
COMMIT=$(curl -sf "https://api.github.com/repos/caffeinelabs/mops/git/tags/${OBJ_SHA}" \
189-
-H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" | \
198+
-H "Authorization: Bearer $GH_TOKEN" | \
190199
python3 -c "import sys,json; print(json.load(sys.stdin)['object']['sha'])")
191200
else
192201
COMMIT="$OBJ_SHA"
193202
fi
194203
echo "commit=$COMMIT" >> $GITHUB_OUTPUT
204+
env:
205+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
195206

196207
- name: Fetch upstream file and build diff
197208
if: steps.check.outputs.needed == 'true'
@@ -234,13 +245,13 @@ jobs:
234245
if: steps.check.outputs.needed == 'true'
235246
run: |
236247
BRANCH="${{ steps.check.outputs.branch }}"
237-
git config user.name "github-actions[bot]"
238-
git config user.email "github-actions[bot]@users.noreply.github.com"
248+
git config user.name "pr-automation-bot-public[bot]"
249+
git config user.email "pr-automation-bot-public[bot]@users.noreply.github.com"
239250
git checkout -b "$BRANCH"
240251
git commit --allow-empty -m "chore: upstream sync check — caffeinelabs/mops ${{ steps.latest.outputs.tag }}"
241252
git push -u origin "$BRANCH"
242253
gh pr create \
243254
--title "chore: sync check — caffeinelabs/mops ${{ steps.latest.outputs.tag }}" \
244255
--body-file /tmp/pr-body.md
245256
env:
246-
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
257+
GH_TOKEN: ${{ steps.app-token.outputs.token }}

0 commit comments

Comments
 (0)
⚡