From 3ae02e4e86394d5fe3f04a982d6dd71641fdab40 Mon Sep 17 00:00:00 2001 From: Maxim Kolyubyakin Date: Sun, 1 Nov 2026 19:06:36 +0100 Subject: [PATCH 1/2] ci(publish): trigger the Homebrew update with a GitHub App token The release job started "Update Homebrew TAP" in cloudblue/homebrew-connect with secrets.PAT_HOMEBREW_CONNECT, a personal access token tied to one person. Mint a short-lived token from the organization's release GitHub App instead (variable RELEASE_APP_ID, secret RELEASE_APP_PRIVATE_KEY). The token is created for owner cloudblue and the repository homebrew-connect only, with the Actions permission (write), which is what `gh workflow run` needs. It is minted right before the step that uses it and revoked when the job ends. PAT_HOMEBREW_CONNECT is no longer used and can be deleted once this is merged. --- .github/workflows/publish.yml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index cec1fc0..970adfe 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -189,9 +189,19 @@ jobs: asset_path: ./connect-cli_${{ steps.tag.outputs.result }}_windows_amd64.zip asset_name: connect-cli_${{ steps.tag.outputs.result }}_windows_amd64.zip asset_content_type: application/zip + # RELEASE_APP_ID may hold the App ID or the Client ID. + - name: Create GitHub App token for Homebrew + id: homebrew-token + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 + with: + client-id: ${{ vars.RELEASE_APP_ID }} + private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} + owner: cloudblue + repositories: homebrew-connect + permission-actions: write - name: Trigger Homebrew Rebuild (CLI) env: - GH_TOKEN: ${{ secrets.PAT_HOMEBREW_CONNECT }} + GH_TOKEN: ${{ steps.homebrew-token.outputs.token }} run: | gh workflow run update.yml \ --repo cloudblue/homebrew-connect \ From f1ac260c8bab694ebd1542b67d6e4abcc4b01a72 Mon Sep 17 00:00:00 2001 From: Maxim Kolyubyakin Date: Sun, 1 Nov 2026 19:06:36 +0100 Subject: [PATCH 2/2] ci(bump): open the dependency bump pull request with a GitHub App token The pull request was created with GITHUB_TOKEN. GitHub does not start workflows for events caused by that token, so build.yml never ran on the bump pull request and the "Allow GitHub Actions to create and approve pull requests" setting had to stay on. Create the pull request with a token from the organization's release GitHub App (variable RELEASE_APP_ID, secret RELEASE_APP_PRIVATE_KEY) instead. The token is limited to this repository with the Contents and Pull requests permissions (write), and is only minted when there is a pull request to open. The pull request now gets the same checks as any other, and the repository setting is no longer needed for this workflow. --- .github/workflows/bump.yml | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/.github/workflows/bump.yml b/.github/workflows/bump.yml index ef56bd5..c6067b6 100644 --- a/.github/workflows/bump.yml +++ b/.github/workflows/bump.yml @@ -71,11 +71,22 @@ jobs: # Remove the temporary file so it is not included in the PR rm outdated.txt + # RELEASE_APP_ID may hold the App ID or the Client ID. + - name: Create GitHub App token + if: steps.check-outdated.outputs.has_updates == 'true' && steps.check-changes.outputs.has_changes == 'true' + id: app-token + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 + with: + client-id: ${{ vars.RELEASE_APP_ID }} + private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} + permission-contents: write + permission-pull-requests: write + - name: Create Pull Request if: steps.check-outdated.outputs.has_updates == 'true' && steps.check-changes.outputs.has_changes == 'true' uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 with: - token: ${{ secrets.GITHUB_TOKEN }} + token: ${{ steps.app-token.outputs.token }} commit-message: 'LITE-33140: Bulk bump modules' branch: LITE-33140-bulk-bump-modules delete-branch: true