From 4df3097715bd141708580d027c53c3bf32c2bfe0 Mon Sep 17 00:00:00 2001 From: Victor Martinez Date: Wed, 18 Sep 2024 15:58:11 +0200 Subject: [PATCH] github-action: use ephemeral tokens with the required permissions (#198) --- .github/workflows/update-specs.yml | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/.github/workflows/update-specs.yml b/.github/workflows/update-specs.yml index 05183cc..f9d6268 100644 --- a/.github/workflows/update-specs.yml +++ b/.github/workflows/update-specs.yml @@ -19,6 +19,18 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Get token + id: get_token + uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0 + with: + app_id: ${{ secrets.OBS_AUTOMATION_APP_ID }} + private_key: ${{ secrets.OBS_AUTOMATION_APP_PEM }} + permissions: >- + { + "contents": "write", + "pull_requests": "write" + } + - uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0 with: registry: ghcr.io @@ -29,13 +41,13 @@ jobs: with: command: --experimental compose diff env: - GITHUB_TOKEN: ${{ secrets.UPDATECLI_GH_TOKEN }} + GITHUB_TOKEN: ${{ steps.get_token.outputs.token }} - uses: elastic/oblt-actions/updatecli/run@v1 with: command: --experimental compose apply env: - GITHUB_TOKEN: ${{ secrets.UPDATECLI_GH_TOKEN }} + GITHUB_TOKEN: ${{ steps.get_token.outputs.token }} - if: failure() uses: elastic/oblt-actions/slack/send@v1