From d565c63e9efb425ca0d54d61b44ef3f25aad5415 Mon Sep 17 00:00:00 2001 From: Nestor Colt Date: Thu, 27 Aug 2026 17:44:48 +0200 Subject: [PATCH] chore(POP-1694): mint release token from cko-public-write App Replaces the manually-managed repo-level PO_GITHUB_TOKEN with a short-lived installation token from the cko-public-write GitHub App, scoped to this repository. Calls actions/create-github-app-token directly: processout/actions is internal and cannot be resolved from a public repository. Verified: processout-android run 33086664703 (ref create + delete). --- .github/workflows/create-release-and-publish.yml | 11 ++++++++++- .github/workflows/create-release-candidate.yml | 11 ++++++++++- .github/workflows/netcetera-update.yml | 11 ++++++++++- 3 files changed, 30 insertions(+), 3 deletions(-) diff --git a/.github/workflows/create-release-and-publish.yml b/.github/workflows/create-release-and-publish.yml index 930a7280e..8cbe5a361 100644 --- a/.github/workflows/create-release-and-publish.yml +++ b/.github/workflows/create-release-and-publish.yml @@ -12,12 +12,21 @@ jobs: - name: Checkout uses: actions/checkout@v4 + - name: Mint App token + id: app-token + uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 #v2 + with: + app-id: ${{ vars.CKO_PUBLIC_WRITE_APP_ID }} + private-key: ${{ secrets.CKO_PUBLIC_WRITE_APP_KEY }} + owner: processout + repositories: processout-android + - name: Create Release run: | RELEASE_VERSION=$(cat version.resolved) gh release create $RELEASE_VERSION --generate-notes env: - GH_TOKEN: ${{ secrets.PO_GITHUB_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} - name: Setup JDK 17 uses: actions/setup-java@v4 diff --git a/.github/workflows/create-release-candidate.yml b/.github/workflows/create-release-candidate.yml index 7f0d7ab19..e894e6e4f 100644 --- a/.github/workflows/create-release-candidate.yml +++ b/.github/workflows/create-release-candidate.yml @@ -27,10 +27,19 @@ jobs: source scripts/update-version.sh --${{ inputs.release_type }} echo "UPDATED_VERSION=$(cat version.resolved)" >> $GITHUB_ENV + - name: Mint App token + id: app-token + uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 #v2 + with: + app-id: ${{ vars.CKO_PUBLIC_WRITE_APP_ID }} + private-key: ${{ secrets.CKO_PUBLIC_WRITE_APP_KEY }} + owner: processout + repositories: processout-android + - name: Create Pull Request uses: peter-evans/create-pull-request@v5.0.0 with: - token: ${{ secrets.PO_GITHUB_TOKEN }} + token: ${{ steps.app-token.outputs.token }} add-paths: version.resolved commit-message: Update version branch: release/${{ env.UPDATED_VERSION }} diff --git a/.github/workflows/netcetera-update.yml b/.github/workflows/netcetera-update.yml index fc1eda847..8b280ff93 100644 --- a/.github/workflows/netcetera-update.yml +++ b/.github/workflows/netcetera-update.yml @@ -48,10 +48,19 @@ jobs: env: NETCETERA_API_KEY: ${{ secrets.NETCETERA_API_KEY }} + - name: Mint App token + id: app-token + uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 #v2 + with: + app-id: ${{ vars.CKO_PUBLIC_WRITE_APP_ID }} + private-key: ${{ secrets.CKO_PUBLIC_WRITE_APP_KEY }} + owner: processout + repositories: processout-android + - name: Create Pull Request uses: peter-evans/create-pull-request@v5.0.0 with: - token: ${{ secrets.PO_GITHUB_TOKEN }} + token: ${{ steps.app-token.outputs.token }} add-paths: | netcetera-3ds-core/src/main/assets/** netcetera-3ds-core/src/main/jniLibs/**