Skip to content

ci: mint a GitHub App token for release-plz instead of using a PAT #537

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
sd2k wants to merge 1 commit into from
+24 −10
Draft

ci: mint a GitHub App token for release-plz instead of using a PAT #537

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 24 additions & 10 deletions .github/workflows/release-plz.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,16 +34,23 @@ jobs:
# Secrets placed in the ci/repo/grafana/augurs/<path> path in Vault
repo_secrets: |
CARGO_REGISTRY_TOKEN=crates-io:api-token
GITHUB_TOKEN=github:token

# TODO: replace `github_app` with the real App name once it exists; see
# https://github.com/grafana/augurs/issues/536. Until then this workflow
# will fail to mint a token.
- id: get-github-token
uses: grafana/shared-workflows/actions/create-github-app-token@46f48da11e78ebdba7a8747ae456b11062fac83e # create-github-app-token/v0.3.1
with:
github_app: augurs-release

- name: Run release-plz
uses: release-plz/action@e8792575c7f2366cf6ff3ccc33ead9ace5b691c7 # v0.5.130
env:
# get-vault-secrets v2 no longer exports secrets as environment
# variables, so they must be passed explicitly to the steps needing
# them. See https://github.com/grafana/shared-workflows/releases/tag/get-vault-secrets%2Fv2.0.0
# Neither get-vault-secrets nor create-github-app-token export their
# secrets as environment variables, so they must be passed explicitly
# to the steps needing them.
CARGO_REGISTRY_TOKEN: ${{ fromJSON(steps.get-secrets.outputs.secrets).CARGO_REGISTRY_TOKEN }}
GITHUB_TOKEN: ${{ fromJSON(steps.get-secrets.outputs.secrets).GITHUB_TOKEN }}
GITHUB_TOKEN: ${{ steps.get-github-token.outputs.token }}
with:
command: release

Expand Down Expand Up @@ -76,15 +83,22 @@ jobs:
# Secrets placed in the ci/repo/grafana/augurs/<path> path in Vault
repo_secrets: |
CARGO_REGISTRY_TOKEN=crates-io:api-token
GITHUB_TOKEN=github:token

# TODO: replace `github_app` with the real App name once it exists; see
# https://github.com/grafana/augurs/issues/536. Until then this workflow
# will fail to mint a token.
- id: get-github-token
uses: grafana/shared-workflows/actions/create-github-app-token@46f48da11e78ebdba7a8747ae456b11062fac83e # create-github-app-token/v0.3.1
with:
github_app: augurs-release

- name: Run release-plz
uses: release-plz/action@e8792575c7f2366cf6ff3ccc33ead9ace5b691c7 # v0.5.130
env:
# get-vault-secrets v2 no longer exports secrets as environment
# variables, so they must be passed explicitly to the steps needing
# them. See https://github.com/grafana/shared-workflows/releases/tag/get-vault-secrets%2Fv2.0.0
# Neither get-vault-secrets nor create-github-app-token export their
# secrets as environment variables, so they must be passed explicitly
# to the steps needing them.
CARGO_REGISTRY_TOKEN: ${{ fromJSON(steps.get-secrets.outputs.secrets).CARGO_REGISTRY_TOKEN }}
GITHUB_TOKEN: ${{ fromJSON(steps.get-secrets.outputs.secrets).GITHUB_TOKEN }}
GITHUB_TOKEN: ${{ steps.get-github-token.outputs.token }}
with:
command: release-pr
Loading