Skip to content

Commit

Permalink
ci: use gh app ephemeral tokens
Browse files Browse the repository at this point in the history
  • Loading branch information
v1v committed Oct 11, 2024
1 parent 83ab249 commit 9b8d4bc
Show file tree
Hide file tree
Showing 2 changed files with 26 additions and 4 deletions.
17 changes: 14 additions & 3 deletions .github/workflows/addToProject.yml
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,20 @@ jobs:
if: github.event.issue && github.event.issue.milestone
runs-on: ubuntu-latest
steps:
- name: Get token
id: get_token
uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
with:
app_id: ${{ secrets.OBS_AUTOMATION_APP_ID }}
private_key: ${{ secrets.OBS_AUTOMATION_APP_PEM }}
permissions: >-
{
"organization_projects": "write",
"issues": "read"
}
- name: Get project data
env:
GITHUB_TOKEN: ${{ secrets.APM_TECH_USER_TOKEN }}
GITHUB_TOKEN: ${{ steps.get_token.outputs.token }}
TEAM: Node.js
ORGANIZATION: elastic
PROJECT_NUMBER: 595
Expand Down Expand Up @@ -49,7 +60,7 @@ jobs:
- name: Add issue to project
env:
GITHUB_TOKEN: ${{ secrets.APM_TECH_USER_TOKEN }}
GITHUB_TOKEN: ${{ steps.get_token.outputs.token }}
ISSUE_ID: ${{ github.event.issue.node_id }}
run: |
item_id="$( gh api graphql -f query='
Expand All @@ -65,7 +76,7 @@ jobs:
- name: Set fields
env:
GITHUB_TOKEN: ${{ secrets.APM_TECH_USER_TOKEN }}
GITHUB_TOKEN: ${{ steps.get_token.outputs.token }}
run: |
gh api graphql -f query='
mutation (
Expand Down
13 changes: 12 additions & 1 deletion .github/workflows/labeler.yml
Original file line number Diff line number Diff line change
Expand Up @@ -15,12 +15,23 @@ jobs:
triage:
runs-on: ubuntu-latest
steps:
- name: Get token
id: get_token
uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
with:
app_id: ${{ secrets.OBS_AUTOMATION_APP_ID }}
private_key: ${{ secrets.OBS_AUTOMATION_APP_PEM }}
permissions: >-
{
"members": "read"
}
- id: is_elastic_member
uses: elastic/oblt-actions/github/is-member-of@v1
with:
github-org: "elastic"
github-user: ${{ github.actor }}
github-token: ${{ secrets.APM_TECH_USER_TOKEN }}
github-token: ${{ steps.get_token.outputs.token }}

- name: Add community and triage labels
if: contains(steps.is_elastic_member.outputs.result, 'false') && github.actor != 'dependabot[bot]'
Expand Down

0 comments on commit 9b8d4bc

Please sign in to comment.