Use app-generated access token

OAI · Dec 22, 2024 · 7924d7f · 7924d7f
1 parent 0615263
commit 7924d7f
Showing 1 changed file with 13 additions and 6 deletions.
diff --git a/.github/workflows/schema-publish.yaml b/.github/workflows/schema-publish.yaml
@@ -18,6 +18,15 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      - name: Generate access token
+        id: generate-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.OAI_SPEC_PUBLISHER_APPID }}
+          private-key: ${{ secrets.OAI_SPEC_PUBLISHER_PRIVATE_KEY }}
+          owner: OAI
+          repositories: OpenAPI-Specification
+
       - uses: actions/checkout@v4 # checkout main branch
         with:
           fetch-depth: 0
@@ -31,7 +40,7 @@ jobs:
 
       - uses: actions/checkout@v4 # checkout gh-pages branch
         with:
-          token: ${{ secrets.OAS_REPO_TOKEN }}
+          token: ${{ steps.generate-token.outputs.token }}
           repository: OAI/OpenAPI-Specification
           ref: gh-pages
           path: deploy
@@ -42,16 +51,14 @@ jobs:
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@v7
         with:
-          # A personal access token is required to push changes to the repository.
-          # This token needs to be refreshed regularly and stored in the repository secrets.
-          token: ${{ secrets.OAS_REPO_TOKEN }}
+          token: ${{ steps.generate-token.outputs.token }}
           branch: publish-arazzo-schema-iteration
           base: gh-pages
           delete-branch: true
           path: deploy
           labels: Housekeeping,Schema
-          reviewers: darrelmiller,webron,earth2marsh,lornajane,mikekistler,miqui,handrews
-          title: Publish Arazzo Schema Iterations
+          reviewers: darrelmiller,webron,earth2marsh,lornajane,mikekistler,miqui,handrews,ralfhandl
+          title: Arazzo - Publish Schema Iterations
           commit-message: New Arazzo schema iterations
           signoff: true
           body: |