From 290b7fabd99b800d1af649dbae051505dfce7c64 Mon Sep 17 00:00:00 2001 From: Nestor Colt Date: Thu, 27 Aug 2026 17:44:48 +0200 Subject: [PATCH] chore(POP-1694): mint release token from cko-public-write App Replaces the manually-managed repo-level PO_GITHUB_TOKEN with a short-lived installation token from the cko-public-write GitHub App, scoped to this repository. Calls actions/create-github-app-token directly: processout/actions is internal and cannot be resolved from a public repository. Verified: processout-android run 33086664703 (ref create + delete). --- .github/workflows/create_release.yml | 10 +++++++++- .github/workflows/create_release_candidate.yml | 10 +++++++++- 2 files changed, 18 insertions(+), 2 deletions(-) diff --git a/.github/workflows/create_release.yml b/.github/workflows/create_release.yml index 3fbbe9213..6dc1140b3 100644 --- a/.github/workflows/create_release.yml +++ b/.github/workflows/create_release.yml @@ -14,7 +14,15 @@ jobs: uses: actions/checkout@v4 - name: Bootstrap Project uses: ./.github/actions/bootstrap-project + - name: Mint App token + id: app-token + uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 #v2 + with: + app-id: ${{ vars.CKO_PUBLIC_WRITE_APP_ID }} + private-key: ${{ secrets.CKO_PUBLIC_WRITE_APP_KEY }} + owner: processout + repositories: processout-ios - name: Create Release env: - GH_TOKEN: ${{ secrets.PO_GITHUB_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} run: source Scripts/CreateRelease.sh diff --git a/.github/workflows/create_release_candidate.yml b/.github/workflows/create_release_candidate.yml index 151a27ee4..ba0bdcc13 100644 --- a/.github/workflows/create_release_candidate.yml +++ b/.github/workflows/create_release_candidate.yml @@ -24,10 +24,18 @@ jobs: run: | source Scripts/UpdateVersion.sh --${{ inputs.release_type }} echo "UPDATED_VERSION=$(cat Version.resolved)" >> $GITHUB_ENV + - name: Mint App token + id: app-token + uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 #v2 + with: + app-id: ${{ vars.CKO_PUBLIC_WRITE_APP_ID }} + private-key: ${{ secrets.CKO_PUBLIC_WRITE_APP_KEY }} + owner: processout + repositories: processout-ios - name: Create Pull Request uses: peter-evans/create-pull-request@v5.0.0 with: - token: ${{ secrets.PO_GITHUB_TOKEN }} + token: ${{ steps.app-token.outputs.token }} add-paths: | *.podspec Version.resolved