From 3954100889062d9fb7707a8255973bc144e225e8 Mon Sep 17 00:00:00 2001
From: S34N <12197162+S34NW@users.noreply.github.com>
Date: Tue, 26 Mar 2024 22:19:30 +0000
Subject: [PATCH] Use a github app token, not the default token, to run
 !merge_upstream workflow actions (#24822)

* Use GitHub App Token instead of built-in token

* the important token location, and simplify

* nanomap render

* Update .github/workflows/merge_upstream_master.yml

Co-authored-by: Arthri <41360489+Arthri@users.noreply.github.com>

* further updates

* formatting

---------

Co-authored-by: Arthri <41360489+Arthri@users.noreply.github.com>
---
 .github/workflows/merge_upstream_master.yml | 15 +++++++-----
 .github/workflows/render_nanomaps.yml       | 27 ++++++++-------------
 2 files changed, 19 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/merge_upstream_master.yml b/.github/workflows/merge_upstream_master.yml
index 94cad7e5bae..7809101f7b9 100644
--- a/.github/workflows/merge_upstream_master.yml
+++ b/.github/workflows/merge_upstream_master.yml
@@ -1,7 +1,7 @@
 name: Merge Upstream Master
 on:
   issue_comment:
-    types: [created]
+    types: created
 
 jobs:
   merge-upstream:
@@ -15,9 +15,15 @@ jobs:
 
     runs-on: ubuntu-latest
     steps:
+      - id: create_token
+        uses: tibdex/github-app-token@v2
+        with:
+          app_id: ${{ secrets.APP_ID }}
+          private_key: ${{ secrets.PRIVATE_KEY }}
+
       - name: PR Data
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.create_token.outputs.token }}
         run: |
           pr_json=$(curl -L -s --fail-with-body -H "Authorization: token ${{ github.token }}" ${{ github.event.issue.pull_request.url }})
           if [ `jq -r '.maintainer_can_modify' <<<$pr_json` == "false" ] ; then
@@ -84,7 +90,4 @@ jobs:
 
       - name: Notify Failure
         if: failure()
-        run: |
-          curl -s -H "Authorization: token ${{ github.token }}" \
-            -X POST -d '{"body": "Merging upstream failed:\nhttps://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"}' \
-            "https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.issue.number }}/comments"
+        run: gh pr comment ${{ github.event.issue.html_url }} -b "Merging upstream failed:\nhttps://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
diff --git a/.github/workflows/render_nanomaps.yml b/.github/workflows/render_nanomaps.yml
index 5b348499cde..305e55553ed 100644
--- a/.github/workflows/render_nanomaps.yml
+++ b/.github/workflows/render_nanomaps.yml
@@ -9,19 +9,21 @@ on:
     - cron: "0 0 * * *"
   workflow_dispatch:
 
-permissions:
-  contents: read
-
 jobs:
   generate_maps:
-    permissions:
-      contents: write  # for Git to git push
-      pull-requests: write  # for repo-sync/pull-request to create pull requests
     name: 'Generate NanoMaps'
     runs-on: ubuntu-22.04
     steps:
+    - id: create_token
+      uses: tibdex/github-app-token@v2
+      with:
+        app_id: ${{ secrets.APP_ID }}
+        private_key: ${{ secrets.PRIVATE_KEY }}
+
     - name: 'Update Branch'
       uses: actions/checkout@v4
+      env:
+        GH_TOKEN: ${{ steps.create_token.outputs.token }}
 
     - name: Branch
       run: |
@@ -32,20 +34,11 @@ jobs:
     - name: 'Generate Maps'
       run: './tools/github-actions/nanomap-renderer-invoker.sh'
 
-    - name: 'Commit Maps'
+    - name: 'Commit Maps and open PR'
       run: |
         git config --local user.email "action@github.com"
         git config --local user.name "NanoMap Generation"
         git pull origin master
         git commit -m "NanoMap Auto-Update (`date`)" -a || true
         git push -f -u origin nanomap-render
-
-    - name: Create Pull Request
-      uses: repo-sync/pull-request@v2
-      with:
-        source_branch: "nanomap-render"
-        destination_branch: "master"
-        pr_title: "Automatic NanoMap Update"
-        pr_body: "This pull request updates the server NanoMaps. Please review the diff images before merging."
-        pr_label: "NanoMaps"
-        pr_allow_empty: false
+        gh pr create -t "Automatic NanoMap Update" -b "This pull request updates the server NanoMaps. Please review the diff images before merging." -l "NanoMaps" -H "nanomap-render" -B "master"