Merge pull request #302 from OAI/workflows-with-app-token

Workflows with app-generated access token
OAI · Dec 23, 2024 · e2b8bae · e2b8bae
2 parents 0615263 + a32e593
commit e2b8bae
Show file tree

Hide file tree

Showing 2 changed files with 26 additions and 10 deletions.
diff --git a/.github/workflows/respec.yaml b/.github/workflows/respec.yaml
@@ -19,9 +19,18 @@ on:
 jobs:
   respec:
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     steps:
+    - name: Generate access token
+      id: generate-token
+      uses: actions/create-github-app-token@v1
+      with:
+        app-id: ${{ secrets.OAI_SPEC_PUBLISHER_APPID }}
+        private-key: ${{ secrets.OAI_SPEC_PUBLISHER_PRIVATE_KEY }}
+        owner: OAI
+        repositories: OpenAPI-Specification
+
     - uses: actions/checkout@v4 # checkout main branch
       with:
         fetch-depth: 0
@@ -35,7 +44,7 @@ jobs:
 
     - uses: actions/checkout@v4 # checkout gh-pages branch
       with:
-        token: ${{ secrets.OAS_REPO_TOKEN }}
+        token: ${{ steps.generate-token.outputs.token }}
         repository: OAI/OpenAPI-Specification  
         ref: gh-pages
         path: deploy
@@ -48,13 +57,13 @@ jobs:
     - name: Create Pull Request
       uses: peter-evans/create-pull-request@v6
       with:
-        token: ${{ secrets.OAS_REPO_TOKEN }}
+        token: ${{ steps.generate-token.outputs.token }}
         branch: update-arazzo-respec-version
         base: gh-pages
         delete-branch: true
         path: deploy
         labels: Housekeeping
-        reviewers: darrelmiller,webron,earth2marsh,webron,lornajane,mikekistler,miqui,handrews,karenetheridge # ralfhandl
+        reviewers: darrelmiller,webron,earth2marsh,webron,lornajane,mikekistler,miqui,handrews,karenetheridge,ralfhandl
         title: Arazzo - Update ReSpec-rendered specification versions
         commit-message: Update ReSpec-rendered specification versions
         signoff: true

diff --git a/.github/workflows/schema-publish.yaml b/.github/workflows/schema-publish.yaml
@@ -18,6 +18,15 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      - name: Generate access token
+        id: generate-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.OAI_SPEC_PUBLISHER_APPID }}
+          private-key: ${{ secrets.OAI_SPEC_PUBLISHER_PRIVATE_KEY }}
+          owner: OAI
+          repositories: OpenAPI-Specification
+
       - uses: actions/checkout@v4 # checkout main branch
         with:
           fetch-depth: 0
@@ -31,7 +40,7 @@ jobs:
 
       - uses: actions/checkout@v4 # checkout gh-pages branch
         with:
-          token: ${{ secrets.OAS_REPO_TOKEN }}
+          token: ${{ steps.generate-token.outputs.token }}
           repository: OAI/OpenAPI-Specification
           ref: gh-pages
           path: deploy
@@ -42,16 +51,14 @@ jobs:
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@v7
         with:
-          # A personal access token is required to push changes to the repository.
-          # This token needs to be refreshed regularly and stored in the repository secrets.
-          token: ${{ secrets.OAS_REPO_TOKEN }}
+          token: ${{ steps.generate-token.outputs.token }}
           branch: publish-arazzo-schema-iteration
           base: gh-pages
           delete-branch: true
           path: deploy
           labels: Housekeeping,Schema
-          reviewers: darrelmiller,webron,earth2marsh,lornajane,mikekistler,miqui,handrews
-          title: Publish Arazzo Schema Iterations
+          reviewers: darrelmiller,webron,earth2marsh,lornajane,mikekistler,miqui,handrews,ralfhandl
+          title: Arazzo - Publish Schema Iterations
           commit-message: New Arazzo schema iterations
           signoff: true
           body: |