Fully switch to the GitHubApp token action

- Fix --ensure-release not having the token set. - Remove `--token-output-file` command. - Remove upload code coverage dependency on releasenotes.
2026-08-23 13:07:07 +01:00 · 2024-08-21 03:59:22 -04:00
parent d965d3c957
commit 726e5fb2ee
7 changed files with 162 additions and 205 deletions
@@ -39,7 +39,6 @@ env:
  TGS_DOTNET_QUALITY: ga
  TGS_WEBPANEL_NODE_VERSION: 20.x
  TGS_TEST_GITHUB_TOKEN: ${{ secrets.LIVE_TESTS_TOKEN }}
-  TGS_RELEASE_NOTES_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
  PACKAGING_PRIVATE_KEY_PASSPHRASE: ${{ secrets.PACKAGING_PRIVATE_KEY_PASSPHRASE }}

 concurrency:
@@ -345,17 +344,20 @@ jobs:
          name: release_notes_bins
          path: release_notes_bins

+      - name: Generate App Token
+        id: app-token-generation
+        uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc
+        with:
+          app_id: ${{ secrets.APP_ID }}
+          private_key: ${{ secrets.APP_PRIVATE_KEY }}
+
      - name: Compile Changelog (Incremental)
+        env:
+          TGS_RELEASE_NOTES_TOKEN: ${{ steps.app-token-generation.outputs.token }}
        run: |
          mv $HOME/tgsdox/changelog.yml ./ 2>/dev/null
          dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --generate-full-notes

-      - name: Generate App Token
-        run: |
-          dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --token-output-file ${{ runner.temp }}/installation_secret.txt ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }}
-          echo "INSTALLATION_TOKEN=$(cat ${{ runner.temp }}/installation_secret.txt)" >> $GITHUB_ENV
-          rm ${{ runner.temp }}/installation_secret.txt
-
      - name: Patch Doxyfile
        run: |
          VERSION=$(cat "build/Version.props" | grep -oPm1 "(?<=<TgsCoreVersion>)[^<]+")
@@ -367,7 +369,7 @@ jobs:
          doxyfile-path: "docs/Doxyfile"

      - name: gh-pages Push
-        if: github.event_name == 'push' && github.event.ref == 'refs/heads/dev' && env.TGS_RELEASE_NOTES_TOKEN != ''
+        if: github.event_name == 'push' && github.event.ref == 'refs/heads/dev'
        run: |
          pushd $HOME/tgsdox
          rm -r *
@@ -388,7 +390,7 @@ jobs:
          echo "Committing..."
          git diff-index --quiet HEAD || git commit -m "Deploy code docs to GitHub Pages for workflow run ${{ github.run_number }}" -m "Commit: ${{ github.event.head_commit.id }}"
          echo "Pushing..."
-          git push -f "https://tgstation-server-ci:${{ env.INSTALLATION_TOKEN }}@github.com/tgstation/tgstation-server" 2>&1
+          git push -f "https://tgstation-server-ci:${{ steps.app-token-generation.outputs.token }}@github.com/tgstation/tgstation-server" 2>&1

  docker-build:
    name: Build Docker Image
@@ -973,7 +975,6 @@ jobs:
        linux-integration-tests,
        windows-unit-tests,
        windows-integration-tests,
-        build-releasenotes,
      ]
    runs-on: ubuntu-latest
    steps:
@@ -1291,15 +1292,24 @@ jobs:
          name: release_notes_bins
          path: release_notes_bins

+      - name: Generate App Token
+        id: app-token-generation
+        uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc
+        with:
+          app_id: ${{ secrets.APP_ID }}
+          private_key: ${{ secrets.APP_PRIVATE_KEY }}
+
      - name: Execute Build Script (Unsigned)
        if: (!(github.event_name == 'push' && contains(github.event.head_commit.message, '[TGSDeploy]') && github.event.ref == 'refs/heads/master'))
        env:
+          TGS_RELEASE_NOTES_TOKEN: ${{ steps.app-token-generation.outputs.token }}
          RELEASE_NOTES_DLL_PATH: ${{ github.workspace }}/release_notes_bins/Tgstation.Server.ReleaseNotes.dll
        run: sudo -E build/package/deb/build_package.sh

      - name: Execute Build Script (Signed)
        if: (github.event_name == 'push' && contains(github.event.head_commit.message, '[TGSDeploy]') && github.event.ref == 'refs/heads/master')
        env:
+          TGS_RELEASE_NOTES_TOKEN: ${{ steps.app-token-generation.outputs.token }}
          RELEASE_NOTES_DLL_PATH: ${{ github.workspace }}/release_notes_bins/Tgstation.Server.ReleaseNotes.dll
          PACKAGING_KEYGRIP: ${{ vars.PACKAGING_KEYGRIP }}
        run: sudo -E build/package/deb/build_package.sh
@@ -1538,7 +1548,16 @@ jobs:
          name: release_notes_bins
          path: release_notes_bins

+      - name: Generate App Token
+        id: app-token-generation
+        uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc
+        with:
+          app_id: ${{ secrets.APP_ID }}
+          private_key: ${{ secrets.APP_PRIVATE_KEY }}
+
      - name: Run ReleaseNotes Check
+        env:
+          TGS_RELEASE_NOTES_TOKEN: ${{ steps.app-token-generation.outputs.token }}
        run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --winget-template-check ${{ steps.get-sha.outputs.pr_template_sha }}

  ci-completion-gate:
@@ -1609,22 +1628,23 @@ jobs:
          name: release_notes_bins
          path: release_notes_bins

-      - name: Generate Release Notes
-        run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll ${{ env.TGS_API_VERSION }} --httpapi
-
      - name: Generate App Token
-        shell: powershell
-        run: |
-          dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --token-output-file ${{ runner.temp }}/installation_secret.txt ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }}
-          $installSecret = Get-Content ${{ runner.temp }}/installation_secret.txt
-          echo "INSTALLATION_TOKEN=$installSecret" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
-          rm ${{ runner.temp }}/installation_secret.txt
+        id: app-token-generation
+        uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc
+        with:
+          app_id: ${{ secrets.APP_ID }}
+          private_key: ${{ secrets.APP_PRIVATE_KEY }}
+
+      - name: Generate Release Notes
+        env:
+          TGS_RELEASE_NOTES_TOKEN: ${{ steps.app-token-generation.outputs.token }}
+        run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll ${{ env.TGS_API_VERSION }} --httpapi

      - name: Create GitHub Release
        uses: actions/create-release@v1
        id: create_release
        env:
-          GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }}
        with:
          tag_name: api-v${{ env.TGS_API_VERSION }}
          release_name: tgstation-server API v${{ env.TGS_API_VERSION }}
@@ -1634,7 +1654,7 @@ jobs:
      - name: Upload OpenApi Spec
        uses: actions/upload-release-asset@v1
        env:
-          GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }}
        with:
          upload_url: ${{ steps.create_release.outputs.upload_url }}
          asset_path: ./swagger/tgs_api.json
@@ -1680,22 +1700,23 @@ jobs:
          name: release_notes_bins
          path: release_notes_bins

-      - name: Generate Release Notes
-        run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll ${{ env.TGS_DM_VERSION }} --dmapi
-
      - name: Generate App Token
-        shell: powershell
-        run: |
-          dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --token-output-file ${{ runner.temp }}/installation_secret.txt ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }}
-          $installSecret = Get-Content ${{ runner.temp }}/installation_secret.txt
-          echo "INSTALLATION_TOKEN=$installSecret" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
-          rm ${{ runner.temp }}/installation_secret.txt
+        id: app-token-generation
+        uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc
+        with:
+          app_id: ${{ secrets.APP_ID }}
+          private_key: ${{ secrets.APP_PRIVATE_KEY }}
+
+      - name: Generate Release Notes
+        env:
+          TGS_RELEASE_NOTES_TOKEN: ${{ steps.app-token-generation.outputs.token }}
+        run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll ${{ env.TGS_DM_VERSION }} --dmapi

      - name: Create GitHub Release
        uses: actions/create-release@v1
        id: create_release
        env:
-          GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }}
        with:
          tag_name: dmapi-v${{ env.TGS_DM_VERSION }}
          release_name: tgstation-server DMAPI v${{ env.TGS_DM_VERSION }}
@@ -1705,7 +1726,7 @@ jobs:
      - name: Upload DMAPI Artifact
        uses: actions/upload-release-asset@v1
        env:
-          GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }}
        with:
          upload_url: ${{ steps.create_release.outputs.upload_url }}
          asset_path: ./DMAPI.zip
@@ -1736,7 +1757,16 @@ jobs:
          name: release_notes_bins
          path: release_notes_bins

+      - name: Generate App Token
+        id: app-token-generation
+        uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc
+        with:
+          app_id: ${{ secrets.APP_ID }}
+          private_key: ${{ secrets.APP_PRIVATE_KEY }}
+
      - name: Generate Release Notes
+        env:
+          TGS_RELEASE_NOTES_TOKEN: ${{ steps.app-token-generation.outputs.token }}
        run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --nuget

      - name: Publish Tgstation.Server.Common to NuGet
@@ -1781,7 +1811,16 @@ jobs:
          name: release_notes_bins
          path: release_notes_bins

+      - name: Generate App Token
+        id: app-token-generation
+        uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc
+        with:
+          app_id: ${{ secrets.APP_ID }}
+          private_key: ${{ secrets.APP_PRIVATE_KEY }}
+
      - name: Run ReleaseNotes with --ensure-release
+        env:
+          TGS_RELEASE_NOTES_TOKEN: ${{ steps.app-token-generation.outputs.token }}
        run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --ensure-release ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }}

  deploy-tgs:
@@ -1920,22 +1959,23 @@ jobs:
          name: release_notes_bins
          path: release_notes_bins

-      - name: Generate Release Notes
-        run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll ${{ env.TGS_VERSION }}
-
      - name: Generate App Token
-        shell: powershell
-        run: |
-          dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --token-output-file ${{ runner.temp }}/installation_secret.txt ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }}
-          $installSecret = Get-Content ${{ runner.temp }}/installation_secret.txt
-          echo "INSTALLATION_TOKEN=$installSecret" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
-          rm ${{ runner.temp }}/installation_secret.txt
+        id: app-token-generation
+        uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc
+        with:
+          app_id: ${{ secrets.APP_ID }}
+          private_key: ${{ secrets.APP_PRIVATE_KEY }}
+
+      - name: Generate Release Notes
+        env:
+          TGS_RELEASE_NOTES_TOKEN: ${{ steps.app-token-generation.outputs.token }}
+        run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll ${{ env.TGS_VERSION }}

      - name: Create GitHub Release
        uses: actions/create-release@v1
        id: create_release
        env:
-          GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }}
        with:
          tag_name: tgstation-server-v${{ env.TGS_VERSION }}
          release_name: tgstation-server-v${{ env.TGS_VERSION }}
@@ -1945,7 +1985,7 @@ jobs:
      - name: Upload Server Console Artifact
        uses: actions/upload-release-asset@v1
        env:
-          GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }}
        with:
          upload_url: ${{ steps.create_release.outputs.upload_url }}
          asset_path: ./ServerConsole.zip
@@ -1955,7 +1995,7 @@ jobs:
      - name: Upload Server Service Artifact
        uses: actions/upload-release-asset@v1
        env:
-          GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }}
        with:
          upload_url: ${{ steps.create_release.outputs.upload_url }}
          asset_path: ./ServerService.zip
@@ -1965,7 +2005,7 @@ jobs:
      - name: Upload DMAPI Artifact
        uses: actions/upload-release-asset@v1
        env:
-          GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }}
        with:
          upload_url: ${{ steps.create_release.outputs.upload_url }}
          asset_path: ./DMAPI.zip
@@ -1975,7 +2015,7 @@ jobs:
      - name: Upload OpenApi Spec Artifact
        uses: actions/upload-release-asset@v1
        env:
-          GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }}
        with:
          upload_url: ${{ steps.create_release.outputs.upload_url }}
          asset_path: ./swagger/tgs_api.json
@@ -1985,7 +2025,7 @@ jobs:
      - name: Upload Server Update Package Artifact
        uses: actions/upload-release-asset@v1
        env:
-          GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }}
        with:
          upload_url: ${{ steps.create_release.outputs.upload_url }}
          asset_path: ./ServerUpdatePackage.zip
@@ -1995,7 +2035,7 @@ jobs:
      - name: Upload Debian Pacakaging Artifact
        uses: actions/upload-release-asset@v1
        env:
-          GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }}
        with:
          upload_url: ${{ steps.create_release.outputs.upload_url }}
          asset_path: ./packaging-debian/tgstation-server-v${{ env.TGS_VERSION }}.debian.packaging.tar.xz
@@ -2005,7 +2045,7 @@ jobs:
      - name: Upload MariaDB .msi
        uses: actions/upload-release-asset@v1
        env:
-          GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }}
        with:
          upload_url: ${{ steps.create_release.outputs.upload_url }}
          asset_path: ./build/package/winget/Tgstation.Server.Host.Service.Wix.Bundle/bin/Release/mariadb.msi
@@ -2015,7 +2055,7 @@ jobs:
      - name: Upload Installer .exe
        uses: actions/upload-release-asset@v1
        env:
-          GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }}
        with:
          upload_url: ${{ steps.create_release.outputs.upload_url }}
          asset_path: ./build/package/winget/tgstation-server-installer.exe
@@ -2043,7 +2083,16 @@ jobs:
          name: release_notes_bins
          path: release_notes_bins

+      - name: Generate App Token
+        id: app-token-generation
+        uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc
+        with:
+          app_id: ${{ secrets.APP_ID }}
+          private_key: ${{ secrets.APP_PRIVATE_KEY }}
+
      - name: Compile Changelog (Incremental)
+        env:
+          TGS_RELEASE_NOTES_TOKEN: ${{ steps.app-token-generation.outputs.token }}
        run: |
          mv $HOME/tgsdox/changelog.yml ./ 2>/dev/null
          dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --generate-full-notes
@@ -2068,7 +2117,7 @@ jobs:
          echo "Committing..."
          git diff-index --quiet HEAD || git commit -m "Regenerate changelog post deploy for workflow run ${{ github.run_number }}" -m "Commit: ${{ github.event.head_commit.id }}"
          echo "Pushing..."
-          git push -f "https://tgstation-server-ci:${{ env.INSTALLATION_TOKEN }}@github.com/tgstation/tgstation-server" 2>&1
+          git push -f "https://tgstation-server-ci:${{ steps.app-token-generation.outputs.token }}@github.com/tgstation/tgstation-server" 2>&1

  deploy-docker:
    name: Deploy TGS (Docker)
@@ -2162,6 +2211,8 @@ jobs:
        shell: powershell
        run: Sleep 600

-      - name: Run ReleaseNotes with --link-winget
+      - name: Ensure Latest Release is TGS Release
+        env:
+          TGS_RELEASE_NOTES_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }} # Has to be a user here
        shell: powershell
        run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --link-winget ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
@@ -23,36 +23,47 @@ jobs:
    permissions:
      pull-requests: write
    steps:
+      - name: Generate App Token
+        id: app-token-generation
+        uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc
+        with:
+          app_id: ${{ secrets.APP_ID }}
+          private_key: ${{ secrets.APP_PRIVATE_KEY }}
+
      - name: Comment on new Fork PR
        if: github.event.action == 'opened' && !contains(github.event.pull_request.labels.*.name, 'CI Cleared') && github.event.pull_request.user.id != 49699333
        uses: thollander/actions-comment-pull-request@1d3973dc4b8e1399c0620d3f2b1aa5e795465308
        with:
          message: Thank you for contributing to ${{ github.event.pull_request.base.repo.name }}! The workflow '${{ github.workflow }}' requires repository secrets and will not run without approval. Maintainers can add the `CI Cleared` label to allow it to run. Note that any changes to ci-security.yml and ci-pipeline.yml will not be reflected.
+          GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }}

      - name: Comment on dependabot PR
        if: github.event.action == 'opened' && !contains(github.event.pull_request.labels.*.name, 'CI Cleared') && github.event.pull_request.user.id == 49699333
        uses: thollander/actions-comment-pull-request@1d3973dc4b8e1399c0620d3f2b1aa5e795465308
        with:
          message: Set the milestone to the next minor version, check for supply chain attacks, and then add the `CI Cleared` label to allow CI to run.
+          GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }}

      - name: "Remove Stale 'CI Cleared' Label"
        if: github.event.action == 'synchronize' || github.event.action == 'reopened'
        uses: actions-ecosystem/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0
        with:
          labels: CI Cleared
+          github_token: ${{ steps.app-token-generation.outputs.token }}

      - name: "Remove 'CI Approval Required' Label"
        if: (github.event.action == 'synchronize' || github.event.action == 'reopened') || ((github.event.action == 'opened' || github.event.action == 'labeled') && contains(github.event.pull_request.labels.*.name, 'CI Cleared'))
        uses: actions-ecosystem/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0
        with:
          labels: CI Approval Required
+          github_token: ${{ steps.app-token-generation.outputs.token }}

      - name: "Add 'CI Approval Required' Label"
        if: (github.event.action == 'synchronize' || github.event.action == 'reopened') || ((github.event.action == 'opened' || github.event.action == 'labeled') && !contains(github.event.pull_request.labels.*.name, 'CI Cleared'))
        uses: actions-ecosystem/action-add-labels@bd52874380e3909a1ac983768df6976535ece7f8
        with:
          labels: CI Approval Required
-          github_token: ${{ github.token }}
+          github_token: ${{ steps.app-token-generation.outputs.token }}

      - name: Fail if PR has Unlabeled new Commits from User
        if: (github.event.action == 'synchronize' || github.event.action == 'reopened') || ((github.event.action == 'opened' || github.event.action == 'labeled') && !contains(github.event.pull_request.labels.*.name, 'CI Cleared'))
@@ -21,25 +21,14 @@ jobs:
    runs-on: ubuntu-latest
    if: github.event.pull_request.user.id == 49699333
    steps:
-      - name: Setup dotnet
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: ${{ env.TGS_DOTNET_VERSION }}.0.x
-          dotnet-quality: ${{ env.TGS_DOTNET_QUALITY }}
-
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Build ReleaseNotes
-        run: dotnet publish -c Release -p:TGS_HOST_NO_WEBPANEL=true -o release_notes_bins tools/Tgstation.Server.ReleaseNotes/Tgstation.Server.ReleaseNotes.csproj
-
      - name: Generate App Token
-        run: |
-          dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --token-output-file ${{ runner.temp }}/installation_secret.txt ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }}
-          echo "INSTALLATION_TOKEN=$(cat ${{ runner.temp }}/installation_secret.txt)" >> $GITHUB_ENV
-          rm ${{ runner.temp }}/installation_secret.txt
+        id: app-token-generation
+        uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc
+        with:
+          app_id: ${{ secrets.APP_ID }}
+          private_key: ${{ secrets.APP_PRIVATE_KEY }}

      - name: Enable Automerge
        uses: daneden/enable-automerge-action@f8558b65c5b8d8bfb592c4e74e3d491624a38fbd #v1.0.2-ish
        with:
-          github-token: ${{ env.INSTALLATION_TOKEN }}
+          github-token: ${{ steps.app-token-generation.outputs.token }}
@@ -14,7 +14,14 @@ jobs:
      pull-requests: write
    runs-on: ubuntu-latest
    steps:
-      - name: size-label
-        uses: "pascalgn/size-label-action@bbbaa0d5ccce8e2e76254560df5c64b82dac2e12" # v0.5.2, consider upgrading after https://github.com/pascalgn/size-label-action/pull/54 is merged
+      - name: Generate App Token
+        id: app-token-generation
+        uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc
+        with:
+          app_id: ${{ secrets.APP_ID }}
+          private_key: ${{ secrets.APP_PRIVATE_KEY }}
+
+      - name: Run Labeller
+        uses: pascalgn/size-label-action@bbbaa0d5ccce8e2e76254560df5c64b82dac2e12
        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }}
@@ -15,36 +15,18 @@ jobs:
    name: Master Merge
    runs-on: ubuntu-latest
    steps:
-      - name: Setup dotnet
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: ${{ env.TGS_DOTNET_VERSION }}.0.x
-          dotnet-quality: ${{ env.TGS_DOTNET_QUALITY }}
-
-      - name: Build Checkout
-        uses: actions/checkout@v4
-        with:
-          path: temp_workspace
-
-      - name: Build ReleaseNotes
-        run: |
-          cd temp_workspace
-          dotnet build -c Release -p:TGS_HOST_NO_WEBPANEL=true tools/Tgstation.Server.ReleaseNotes/Tgstation.Server.ReleaseNotes.csproj
-
      - name: Generate App Token
-        run: |
-          cd temp_workspace
-          dotnet run -c Release --no-build --project tools/Tgstation.Server.ReleaseNotes --token-output-file ${{ runner.temp }}/installation_secret.txt ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }}
-          echo "INSTALLATION_TOKEN=$(cat ${{ runner.temp }}/installation_secret.txt)" >> $GITHUB_ENV
-          rm ${{ runner.temp }}/installation_secret.txt
-        env:
-          TGS_RELEASE_NOTES_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
+        id: app-token-generation
+        uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc
+        with:
+          app_id: ${{ secrets.APP_ID }}
+          private_key: ${{ secrets.APP_PRIVATE_KEY }}

-      - name: Main Checkout
+      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
-          token: ${{ env.INSTALLATION_TOKEN }}
+          token: ${{ steps.app-token-generation.outputs.token }}

      - name: Merge master into dev
        uses: robotology/gh-action-nightly-merge@14b4a4cf358f7479aa708bee05cf8a794d6a2516 #v1.5.0
@@ -57,4 +39,4 @@ jobs:
          user_email: 161980869+tgstation-server-ci[bot]@users.noreply.github.com
          push_token: INSTALLATION_TOKEN
        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token-generation.outputs.token }}
@@ -21,37 +21,19 @@ jobs:
    name: Fork Sync
    runs-on: ubuntu-latest
    steps:
-      - name: Setup dotnet
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: ${{ env.TGS_DOTNET_VERSION }}.0.x
-          dotnet-quality: ${{ env.TGS_DOTNET_QUALITY }}
-
-      - name: Build Checkout
-        uses: actions/checkout@v4
-        with:
-          path: temp_workspace
-
-      - name: Build ReleaseNotes
-        run: |
-          cd temp_workspace
-          dotnet build -c Release -p:TGS_HOST_NO_WEBPANEL=true tools/Tgstation.Server.ReleaseNotes/Tgstation.Server.ReleaseNotes.csproj
-
      - name: Generate App Token
-        run: |
-          cd temp_workspace
-          dotnet run -c Release --no-build --project tools/Tgstation.Server.ReleaseNotes --token-output-file ${{ runner.temp }}/installation_secret.txt ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }} --spacestation13
-          echo "INSTALLATION_TOKEN=$(cat ${{ runner.temp }}/installation_secret.txt)" >> $GITHUB_ENV
-          rm ${{ runner.temp }}/installation_secret.txt
-        env:
-          TGS_RELEASE_NOTES_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
+        id: app-token-generation
+        uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc
+        with:
+          app_id: ${{ secrets.APP_ID }}
+          private_key: ${{ secrets.APP_PRIVATE_KEY }}

-      - name: Main Checkout
+      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          fetch-tags: true
-          token: ${{ env.INSTALLATION_TOKEN }}
+          token: ${{ steps.app-token-generation.outputs.token }}

      - name: Build ReleaseNotes
        run: dotnet build -c Release -p:TGS_HOST_NO_WEBPANEL=true tools/Tgstation.Server.ReleaseNotes/Tgstation.Server.ReleaseNotes.csproj
@@ -68,5 +50,5 @@ jobs:
        run: |
          git config user.name "tgstation-server-ci[bot]"
          git config user.email "161980869+tgstation-server-ci[bot]@users.noreply.github.com"
-          git push "https://tgstation-server-ci:${{ env.INSTALLATION_TOKEN }}@github.com/spacestation13/tgstation-server"
-          git push --tags "https://tgstation-server-ci:${{ env.INSTALLATION_TOKEN }}@github.com/spacestation13/tgstation-server"
+          git push "https://tgstation-server-ci:${{ steps.app-token-generation.outputs.token }}@github.com/spacestation13/tgstation-server"
+          git push --tags "https://tgstation-server-ci:${{ steps.app-token-generation.outputs.token }}@github.com/spacestation13/tgstation-server"