From ee8c000f099002f06237e5d1e3f00582b5c6e382 Mon Sep 17 00:00:00 2001
From: Julien <julien@apwide.com>
Date: Mon, 31 Aug 2026 12:01:06 +0200
Subject: [PATCH] chore(workflow): migrated to github app token for git
 operations

---
 .github/workflows/release.yml | 34 ++++++++++++++++++++++++----------
 1 file changed, 24 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 148da07..5d70f87 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,13 +14,21 @@ jobs:
     outputs:
       version: ${{ steps.capture.outputs.version }}
     steps:
+      - name: Get Github App Token
+        uses: actions/create-github-app-token@v3
+        id: app-token
+        with:
+          client-id: ${{ vars.GH_APP_CLIENT_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          token: ${{ steps.app-token.outputs.token }}
       - name: Bump
         if: success()
         uses: 'phips28/gh-action-bump-version@master'
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
         with:
           major-wording: 'BREAKING'
           default: 'minor'
@@ -30,7 +38,7 @@ jobs:
           NODE_OPTIONS: --openssl-legacy-provider
         with:
           node-version-file: .node-version
-          cache: 'npm'
+          package-manager-cache: false
           registry-url: 'https://registry.npmjs.org'
       - name: Install & Build
 #        npm run test
@@ -60,16 +68,19 @@ jobs:
         working-directory: 'actions/golive-send-environment-info'
     runs-on: ubuntu-latest
     steps:
+      - name: Get Github App Token
+        uses: actions/create-github-app-token@v3
+        id: app-token
+        with:
+          client-id: ${{ vars.GH_APP_CLIENT_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
       - uses: actions/checkout@v7
         name: checkout golive-send-environment-info
         with:
           repository: apwide/golive-send-environment-info
           ref: ${{ needs.bump-and-publish.outputs.branch }}
           path: ./actions/golive-send-environment-info
-          token: ${{secrets.CI_GITHUB_TOKEN}}
-      - run: |
-          git config --global user.name 'Apwide CI'
-          git config --global user.email 'ci@apwide.com'
+          token: ${{ steps.app-token.outputs.token }}
       - uses: actions/setup-node@v7
         env:
           NODE_OPTIONS: --openssl-legacy-provider
@@ -96,16 +107,19 @@ jobs:
         working-directory: 'actions/golive-send-release-info'
     runs-on: ubuntu-latest
     steps:
+      - name: Get Github App Token
+        uses: actions/create-github-app-token@v3
+        id: app-token
+        with:
+          client-id: ${{ vars.GH_APP_CLIENT_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
       - uses: actions/checkout@v7
         name: checkout golive-send-release-info
         with:
           repository: apwide/golive-send-release-info
           ref: ${{ needs.bump-and-publish.outputs.branch }}
           path: ./actions/golive-send-release-info
-          token: ${{secrets.CI_GITHUB_TOKEN}}
-      - run: |
-          git config --global user.name 'Apwide CI'
-          git config --global user.email 'ci@apwide.com'
+          token: ${{ steps.app-token.outputs.token }}
       - uses: actions/setup-node@v7
         env:
           NODE_OPTIONS: --openssl-legacy-provider