From 1a0af63c0e799752bdf381bb2f6b8e2ce92aeefc Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Sat, 7 Sep 2024 22:34:52 -0400 Subject: [PATCH] Revert "Revert "Replace COMFY_ORANGE_PAT with tgstation-ci[bot] app token"" (#86529) Reverts tgstation/tgstation#86507 Perms should work now --- .github/workflows/auto_changelog.yml | 14 ++++++++++++- .github/workflows/compile_changelogs.yml | 25 +++++++++++++++++++++--- .github/workflows/update_tgs_dmapi.yml | 20 ++++++++++++++++--- 3 files changed, 52 insertions(+), 7 deletions(-) diff --git a/.github/workflows/auto_changelog.yml b/.github/workflows/auto_changelog.yml index f47c2936980..e08224dfb9a 100644 --- a/.github/workflows/auto_changelog.yml +++ b/.github/workflows/auto_changelog.yml @@ -15,10 +15,22 @@ jobs: steps: - name: Checkout uses: actions/checkout@v4 + + - name: Generate App Token + id: app-token-generation + uses: actions/create-github-app-token@v1 + if: env.APP_PRIVATE_KEY != '' && env.APP_ID != '' + with: + app-id: ${{ secrets.APP_ID }} + private-key: ${{ secrets.APP_PRIVATE_KEY }} + env: + APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }} + APP_ID: ${{ secrets.APP_ID }} + - name: Run auto changelog uses: actions/github-script@v6 with: script: | const { processAutoChangelog } = await import('${{ github.workspace }}/tools/pull_request_hooks/autoChangelog.js') await processAutoChangelog({ github, context }) - github-token: ${{ secrets.COMFY_ORANGE_PAT || secrets.GITHUB_TOKEN }} + github-token: ${{ steps.app-token-generation.outputs.token || secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/compile_changelogs.yml b/.github/workflows/compile_changelogs.yml index e1b8774905f..b3eeeb3fb1e 100644 --- a/.github/workflows/compile_changelogs.yml +++ b/.github/workflows/compile_changelogs.yml @@ -9,6 +9,8 @@ jobs: compile: name: "Compile changelogs" runs-on: ubuntu-22.04 + permissions: + contents: write steps: - name: "Check for ACTION_ENABLER secret and pass true to output if it exists to be checked by later steps" id: value_holder @@ -18,37 +20,54 @@ jobs: unset SECRET_EXISTS if [ -n "$ENABLER_SECRET" ]; then SECRET_EXISTS=true ; fi echo "ACTIONS_ENABLED=$SECRET_EXISTS" >> $GITHUB_OUTPUT + - name: "Setup python" if: steps.value_holder.outputs.ACTIONS_ENABLED uses: actions/setup-python@v1 with: python-version: '3.x' + - name: "Install deps" if: steps.value_holder.outputs.ACTIONS_ENABLED run: | python -m pip install --upgrade pip python -m pip install pyyaml sudo apt-get install dos2unix + - name: "Checkout" if: steps.value_holder.outputs.ACTIONS_ENABLED uses: actions/checkout@v4 with: fetch-depth: 25 persist-credentials: false + - name: "Compile" if: steps.value_holder.outputs.ACTIONS_ENABLED run: | python tools/ss13_genchangelog.py html/changelogs + - name: Commit if: steps.value_holder.outputs.ACTIONS_ENABLED run: | - git config --local user.email "action@github.com" - git config --local user.name "Changelogs" + git config --local user.name "tgstation-ci[bot]" + git config --local user.email "179393467+tgstation-ci[bot]@users.noreply.github.com" git pull origin master git add html/changelogs git commit -m "Automatic changelog compile [ci skip]" -a || true + + - name: Generate App Token + id: app-token-generation + uses: actions/create-github-app-token@v1 + if: env.APP_PRIVATE_KEY != '' && env.APP_ID != '' + with: + app-id: ${{ secrets.APP_ID }} + private-key: ${{ secrets.APP_PRIVATE_KEY }} + env: + APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }} + APP_ID: ${{ secrets.APP_ID }} + - name: "Push" if: steps.value_holder.outputs.ACTIONS_ENABLED uses: ad-m/github-push-action@master with: - github_token: ${{ secrets.COMFY_ORANGE_PAT || secrets.GITHUB_TOKEN }} + github_token: ${{ steps.app-token-generation.outputs.token || secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/update_tgs_dmapi.yml b/.github/workflows/update_tgs_dmapi.yml index 232c02c0ecb..3f7ee320d90 100644 --- a/.github/workflows/update_tgs_dmapi.yml +++ b/.github/workflows/update_tgs_dmapi.yml @@ -9,6 +9,9 @@ jobs: update-dmapi: runs-on: ubuntu-22.04 name: Update the TGS DMAPI + permissions: + contents: write + pull-requests: write steps: - name: Clone uses: actions/checkout@v4 @@ -29,12 +32,23 @@ jobs: - name: Commit and Push continue-on-error: true run: | - git config user.name "tgstation-server-ci[bot]" - git config user.email "161980869+tgstation-server-ci[bot]@users.noreply.github.com" + git config user.name "tgstation-ci[bot]" + git config user.email "179393467+tgstation-ci[bot]@users.noreply.github.com" git add . git commit -m 'Update TGS DMAPI' git push -f -u origin tgs-dmapi-update + - name: Generate App Token + id: app-token-generation + uses: actions/create-github-app-token@v1 + if: env.APP_PRIVATE_KEY != '' && env.APP_ID != '' + with: + app-id: ${{ secrets.APP_ID }} + private-key: ${{ secrets.APP_PRIVATE_KEY }} + env: + APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }} + APP_ID: ${{ secrets.APP_ID }} + - name: Create Pull Request uses: repo-sync/pull-request@v2 if: ${{ success() }} @@ -45,4 +59,4 @@ jobs: pr_body: "This pull request updates the TGS DMAPI to the latest version. Please note any changes that may be breaking or unimplemented in your codebase by checking what changes are in the definitions file: code/__DEFINES/tgs.dm before merging.\n\n${{ steps.dmapi-update.outputs.release-notes }}" pr_label: "Tools" pr_allow_empty: false - github_token: ${{ secrets.COMFY_ORANGE_PAT }} + github_token: ${{ steps.app-token-generation.outputs.token || secrets.GITHUB_TOKEN }}