Revert "Revert "Replace COMFY_ORANGE_PAT with tgstation-ci[bot] app token"" (#86529)

Reverts tgstation/tgstation#86507

Perms should work now

.github/workflows/auto_changelog.yml

@@ -15,10 +15,22 @@ jobs:
     steps:
     - name: Checkout
       uses: actions/checkout@v4
+
+    - name: Generate App Token
+      id: app-token-generation
+      uses: actions/create-github-app-token@v1
+      if: env.APP_PRIVATE_KEY != '' && env.APP_ID != ''
+      with:
+        app-id: ${{ secrets.APP_ID }}
+        private-key: ${{ secrets.APP_PRIVATE_KEY }}
+      env:
+        APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}
+        APP_ID: ${{ secrets.APP_ID }}
+
     - name: Run auto changelog
       uses: actions/github-script@v6
       with:
         script: |
           const { processAutoChangelog } = await import('${{ github.workspace }}/tools/pull_request_hooks/autoChangelog.js')
           await processAutoChangelog({ github, context })
-        github-token: ${{ secrets.COMFY_ORANGE_PAT || secrets.GITHUB_TOKEN }}
+        github-token: ${{ steps.app-token-generation.outputs.token || secrets.GITHUB_TOKEN }}

.github/workflows/compile_changelogs.yml

@@ -9,6 +9,8 @@ jobs:
   compile:
     name: "Compile changelogs"
     runs-on: ubuntu-22.04
+    permissions:
+      contents: write
     steps:
       - name: "Check for ACTION_ENABLER secret and pass true to output if it exists to be checked by later steps"
         id: value_holder
@@ -18,37 +20,54 @@ jobs:
           unset SECRET_EXISTS
           if [ -n "$ENABLER_SECRET" ]; then SECRET_EXISTS=true ; fi
           echo "ACTIONS_ENABLED=$SECRET_EXISTS" >> $GITHUB_OUTPUT
+
       - name: "Setup python"
         if: steps.value_holder.outputs.ACTIONS_ENABLED
         uses: actions/setup-python@v1
         with:
           python-version: '3.x'
+
       - name: "Install deps"
         if: steps.value_holder.outputs.ACTIONS_ENABLED
         run: |
           python -m pip install --upgrade pip
           python -m pip install pyyaml
           sudo apt-get install  dos2unix
+
       - name: "Checkout"
         if: steps.value_holder.outputs.ACTIONS_ENABLED
         uses: actions/checkout@v4
         with:
           fetch-depth: 25
           persist-credentials: false
+
       - name: "Compile"
         if: steps.value_holder.outputs.ACTIONS_ENABLED
         run: |
           python tools/ss13_genchangelog.py html/changelogs
+
       - name: Commit
         if: steps.value_holder.outputs.ACTIONS_ENABLED
         run: |
-          git config --local user.email "action@github.com"
-          git config --local user.name "Changelogs"
+          git config --local user.name "tgstation-ci[bot]"
+          git config --local user.email "179393467+tgstation-ci[bot]@users.noreply.github.com"
           git pull origin master
           git add html/changelogs
           git commit -m "Automatic changelog compile [ci skip]" -a || true
+
+      - name: Generate App Token
+        id: app-token-generation
+        uses: actions/create-github-app-token@v1
+        if: env.APP_PRIVATE_KEY != '' && env.APP_ID != ''
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+        env:
+          APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}
+          APP_ID: ${{ secrets.APP_ID }}
+
       - name: "Push"
         if: steps.value_holder.outputs.ACTIONS_ENABLED
         uses: ad-m/github-push-action@master
         with:
-          github_token: ${{ secrets.COMFY_ORANGE_PAT || secrets.GITHUB_TOKEN }}
+          github_token: ${{ steps.app-token-generation.outputs.token || secrets.GITHUB_TOKEN }}

.github/workflows/update_tgs_dmapi.yml

@@ -9,6 +9,9 @@ jobs:
   update-dmapi:
     runs-on: ubuntu-22.04
     name: Update the TGS DMAPI
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
     - name: Clone
       uses: actions/checkout@v4
@@ -29,12 +32,23 @@ jobs:
     - name: Commit and Push
       continue-on-error: true
       run: |
-        git config user.name "tgstation-server-ci[bot]"
-        git config user.email "161980869+tgstation-server-ci[bot]@users.noreply.github.com"
+        git config user.name "tgstation-ci[bot]"
+        git config user.email "179393467+tgstation-ci[bot]@users.noreply.github.com"
         git add .
         git commit -m 'Update TGS DMAPI'
         git push -f -u origin tgs-dmapi-update
 
+    - name: Generate App Token
+      id: app-token-generation
+      uses: actions/create-github-app-token@v1
+      if: env.APP_PRIVATE_KEY != '' && env.APP_ID != ''
+      with:
+        app-id: ${{ secrets.APP_ID }}
+        private-key: ${{ secrets.APP_PRIVATE_KEY }}
+      env:
+        APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}
+        APP_ID: ${{ secrets.APP_ID }}
+
     - name: Create Pull Request
       uses: repo-sync/pull-request@v2
       if: ${{ success() }}
@@ -45,4 +59,4 @@ jobs:
         pr_body: "This pull request updates the TGS DMAPI to the latest version. Please note any changes that may be breaking or unimplemented in your codebase by checking what changes are in the definitions file: code/__DEFINES/tgs.dm before merging.\n\n${{ steps.dmapi-update.outputs.release-notes }}"
         pr_label: "Tools"
         pr_allow_empty: false
-        github_token: ${{ secrets.COMFY_ORANGE_PAT }}
+        github_token: ${{ steps.app-token-generation.outputs.token || secrets.GITHUB_TOKEN }}