Repository navigation
ci: use the org GitHub App token for the Homebrew trigger and the bump PR - #258
Conversation
The release job started "Update Homebrew TAP" in cloudblue/homebrew-connect with secrets.PAT_HOMEBREW_CONNECT, a personal access token tied to one person. Mint a short-lived token from the organization's release GitHub App instead (variable RELEASE_APP_ID, secret RELEASE_APP_PRIVATE_KEY). The token is created for owner cloudblue and the repository homebrew-connect only, with the Actions permission (write), which is what `gh workflow run` needs. It is minted right before the step that uses it and revoked when the job ends. PAT_HOMEBREW_CONNECT is no longer used and can be deleted once this is merged.
The pull request was created with GITHUB_TOKEN. GitHub does not start workflows for events caused by that token, so build.yml never ran on the bump pull request and the "Allow GitHub Actions to create and approve pull requests" setting had to stay on. Create the pull request with a token from the organization's release GitHub App (variable RELEASE_APP_ID, secret RELEASE_APP_PRIVATE_KEY) instead. The token is limited to this repository with the Contents and Pull requests permissions (write), and is only minted when there is a pull request to open. The pull request now gets the same checks as any other, and the repository setting is no longer needed for this workflow.
|
pcaro
left a comment
pcaro
left a comment
There was a problem hiding this comment.
The workflow changes look right to me. Two things before merging:
1. The PR is no longer a draft and is already approved, but the description says "Draft until the App exists". I don't see RELEASE_APP_ID or RELEASE_APP_PRIVATE_KEY at repo level (only PAT_HOMEBREW_CONNECT), and I can't check org level. If this is merged first, the Monday bump fails at the token step, and the next tag leaves the release job red on its last step. By then the release itself is already published, and the daily cron in homebrew-connect's update.yml catches up, so the impact is small. Before merging, please confirm:
- the App has Actions, Contents and Pull requests set to write,
- it is installed on connect-cli and homebrew-connect,
- the org variable and secret are visible to connect-cli.
2. Minor: bump.yml has no permissions: block. GITHUB_TOKEN keeps the repo default, which is write (it opened #243 through #253), and checkout@v3 persists it in .git/config while poetry update, poetry install and pytest run freshly resolved dependencies. Now that the writes go through the App token, this is enough:
jobs:
bump-dependencies:
runs-on: ubuntu-latest
permissions:
contents: readAfter merging, running bump.yml manually should update #253 as the App, with CI running on it.
What I checked: the pinned SHAs match create-github-app-token v3.3.0 and create-pull-request v7.0.11, client-id accepts either the App ID or the Client ID, and each token only gets the scope its step needs.
What
publish.yml: the step that triggers the Homebrew update uses a token from the org's GitHub App instead ofPAT_HOMEBREW_CONNECT, which is a personal token.bump.yml: the weekly dependency PR is opened with an App token instead ofGITHUB_TOKEN.Why
GITHUB_TOKENdon't run CI. They also need "Allow GitHub Actions to create and approve pull requests", which is now off in the other 22 kept repos, because it lets a workflow approve its own PR. With the App token, connect-cli can switch it off too.Key decisions
vars.RELEASE_APP_ID,secrets.RELEASE_APP_PRIVATE_KEY, installed on connect-cli and homebrew-connect).PAT_HOMEBREW_CONNECTsecret and revoke that token.How it worked before / after