From 9868e189ca60ca7ea9f79ccd8da74c2c66605aa2 Mon Sep 17 00:00:00 2001 From: Vincent Biret Date: Thu, 3 Sep 2026 13:04:24 -0400 Subject: [PATCH 1/4] ci: switches to dedicated identity for promotion PRs Signed-off-by: Vincent Biret --- .github/workflows/promote-shipped-apis.yml | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/.github/workflows/promote-shipped-apis.yml b/.github/workflows/promote-shipped-apis.yml index 52a2010447..aaf0424056 100644 --- a/.github/workflows/promote-shipped-apis.yml +++ b/.github/workflows/promote-shipped-apis.yml @@ -19,23 +19,33 @@ jobs: runs-on: ubuntu-latest steps: + - name: Generate GitHub App token + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ secrets.GHA_TOKEN_PROVIDER_APP_ID }} + private-key: ${{ secrets.GHA_TOKEN_PROVIDER_PEM }} + - name: Checkout code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - token: ${{ secrets.GITHUB_TOKEN }} + token: ${{ steps.app-token.outputs.token }} - name: Configure git shell: pwsh + env: + GH_TOKEN: ${{ steps.app-token.outputs.token }} run: | git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git config user.email "github-actions[bot]@users.noreply.github.com" + git config --global url."https://$($env:GH_TOKEN)@github.com/".insteadOf "https://github.com/" - name: Check for existing PR id: check_pr shell: pwsh env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} run: | $branch = "${{ github.ref_name }}" $prBranch = "promote-shipped-apis-$branch" @@ -95,7 +105,7 @@ jobs: if: steps.check_pr.outputs.pr_exists == 'false' && steps.check_changes.outputs.has_changes == 'true' shell: pwsh env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} run: | $branch = "${{ github.ref_name }}" $prBranch = "promote-shipped-apis-$branch" From b9dbec812fa92b5e4adc541be13012c2f4ddcf42 Mon Sep 17 00:00:00 2001 From: Vincent Biret Date: Thu, 3 Sep 2026 14:43:01 -0400 Subject: [PATCH 2/4] security: trims permissions because we're using a dedicate identity now Signed-off-by: Vincent Biret --- .github/workflows/promote-shipped-apis.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/promote-shipped-apis.yml b/.github/workflows/promote-shipped-apis.yml index aaf0424056..4c99306347 100644 --- a/.github/workflows/promote-shipped-apis.yml +++ b/.github/workflows/promote-shipped-apis.yml @@ -7,8 +7,7 @@ on: workflow_dispatch: permissions: - contents: write - pull-requests: write + contents: read concurrency: group: ${{ github.workflow }}-${{ github.ref }} From 4151fc9832f5909c9819ab1ff7f9be61552ba25f Mon Sep 17 00:00:00 2001 From: Vincent Biret Date: Thu, 3 Sep 2026 14:45:15 -0400 Subject: [PATCH 3/4] ci: aligns tasks permissions with application declaration Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .github/workflows/promote-shipped-apis.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/promote-shipped-apis.yml b/.github/workflows/promote-shipped-apis.yml index 4c99306347..b31dd7d5b2 100644 --- a/.github/workflows/promote-shipped-apis.yml +++ b/.github/workflows/promote-shipped-apis.yml @@ -24,6 +24,8 @@ jobs: with: client-id: ${{ secrets.GHA_TOKEN_PROVIDER_APP_ID }} private-key: ${{ secrets.GHA_TOKEN_PROVIDER_PEM }} + permission-contents: write + permission-pull-requests: write - name: Checkout code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 From 91bd249ab2ad0d158d6cbc64c9ffa7e42e2b9c2f Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 4 Sep 2026 13:53:37 +0000 Subject: [PATCH 4/4] ci: use app bot identity for API promotion commits Co-authored-by: baywet <7905502+baywet@users.noreply.github.com> --- .github/workflows/promote-shipped-apis.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/promote-shipped-apis.yml b/.github/workflows/promote-shipped-apis.yml index b31dd7d5b2..fb4d44ffe4 100644 --- a/.github/workflows/promote-shipped-apis.yml +++ b/.github/workflows/promote-shipped-apis.yml @@ -27,6 +27,13 @@ jobs: permission-contents: write permission-pull-requests: write + - name: Get GitHub App user ID + id: get-user-id + shell: bash + env: + GH_TOKEN: ${{ steps.app-token.outputs.token }} + run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT" + - name: Checkout code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: @@ -38,8 +45,8 @@ jobs: env: GH_TOKEN: ${{ steps.app-token.outputs.token }} run: | - git config user.name "github-actions[bot]" - git config user.email "github-actions[bot]@users.noreply.github.com" + git config user.name "${{ steps.app-token.outputs.app-slug }}[bot]" + git config user.email "${{ steps.get-user-id.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com" git config --global url."https://$($env:GH_TOKEN)@github.com/".insteadOf "https://github.com/" - name: Check for existing PR