robojerk/codeql-action

Use generated token on checkout

Browse source 
The script `.github/update-release-branch.py` uses the `git` command
to push changes. Therefore we need to ensure that `git` authenticates
with a token that has the `workflows` write permision.

This change restore the GitHub token used by the script to access the
API and applies the `workflows` write permission to the token used by `git`.
This commit is contained in:
Remco Vermeulen 2024-09-13 09:13:54 -07:00
parent c101242d73
commit 762210d5a0
1 changed files with 6 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

10
.github/workflows/update-release-branch.yml vendored
View file

@ -115,19 +115,21 @@ jobs:
SOURCE_BRANCH: ${{ needs.prepare.outputs.backport_source_branch }} SOURCE_BRANCH: ${{ needs.prepare.outputs.backport_source_branch }}
TARGET_BRANCH: ${{ matrix.target_branch }} TARGET_BRANCH: ${{ matrix.target_branch }}
steps: steps:
- uses: actions/create-github-app-token@31c86eb3b33c9b601a1f60f98dcbfd1d70f379b4 - name: Generate token
uses: actions/create-github-app-token@31c86eb3b33c9b601a1f60f98dcbfd1d70f379b4
id: app-token id: app-token
with: with:
app-id: ${{ vars.AUTOMATION_APP_ID }} app-id: ${{ vars.AUTOMATION_APP_ID }}
private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }} private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
- uses: actions/checkout@v4
- name: Checkout
uses: actions/checkout@v4
with: with:
fetch-depth: 0 # Need full history for calculation of diffs fetch-depth: 0 # Need full history for calculation of diffs
token: ${{ steps.app-token.outputs.token }}
- uses: ./.github/actions/release-initialise - uses: ./.github/actions/release-initialise
- name: Update older release branch - name: Update older release branch
env:
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
run: | run: |
echo SOURCE_BRANCH=${SOURCE_BRANCH} echo SOURCE_BRANCH=${SOURCE_BRANCH}
echo TARGET_BRANCH=${TARGET_BRANCH} echo TARGET_BRANCH=${TARGET_BRANCH}