From a97469befd94cf1f22b7c946e3df23e6a89ce80e Mon Sep 17 00:00:00 2001 From: Victor Martinez Date: Mon, 9 Sep 2024 13:06:40 +0200 Subject: [PATCH] ci: use ephemeral tokens with the required permissions --- .github/workflows/bump-opbeans-ruby.yml | 14 +++++++++++++- .github/workflows/create-tag.yml | 13 ++++++++++++- 2 files changed, 25 insertions(+), 2 deletions(-) diff --git a/.github/workflows/bump-opbeans-ruby.yml b/.github/workflows/bump-opbeans-ruby.yml index a9f485e..1312ee2 100644 --- a/.github/workflows/bump-opbeans-ruby.yml +++ b/.github/workflows/bump-opbeans-ruby.yml @@ -21,11 +21,23 @@ jobs: with: ruby-version: '2.7.3' + - name: Get token + id: get_token + uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0 + with: + app_id: ${{ secrets.OBS_AUTOMATION_APP_ID }} + private_key: ${{ secrets.OBS_AUTOMATION_APP_PEM }} + permissions: >- + { + "contents": "write", + "pull_requests": "write" + } + - uses: elastic/oblt-actions/updatecli/run@v1 with: command: "--experimental apply --config .ci/bump-opbeans-ruby.yml" env: - GITHUB_TOKEN: ${{ secrets.UPDATECLI_GH_TOKEN }} + GITHUB_TOKEN: ${{ steps.get_token.outputs.token }} - if: failure() uses: elastic/oblt-actions/slack/send@v1 diff --git a/.github/workflows/create-tag.yml b/.github/workflows/create-tag.yml index b284240..5bdce87 100644 --- a/.github/workflows/create-tag.yml +++ b/.github/workflows/create-tag.yml @@ -21,6 +21,17 @@ jobs: with: fetch-depth: 0 # also fetch tags + - name: Get token + id: get_token + uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0 + with: + app_id: ${{ secrets.OBS_AUTOMATION_APP_ID }} + private_key: ${{ secrets.OBS_AUTOMATION_APP_PEM }} + permissions: >- + { + "contents": "write" + } + - run: make create-release env: - GH_TOKEN: ${{ secrets.CREATE_TAG_TOKEN }} + GH_TOKEN: ${{ steps.get_token.outputs.token }}