CI: switch to PAT token (CI token expires once job is done)

Author: DeviaVir

.github/workflows/start-gitlab.yml

@@ -5,9 +5,6 @@ on:
   # It also grants access to secrets needed for the trigger.
   pull_request_target:
     types: [opened, synchronize, reopened]
-# Allow the GITHUB_TOKEN passed on to Gitlab to update the commit status.
-permissions:
-  statuses: write
 jobs:
   trigger-gitlab:
     runs-on: ubuntu-latest
@@ -52,6 +49,5 @@ jobs:
             --form "variables[GITHUB_PR_SHA]=${GITHUB_PR_SHA}" \
             --form "variables[GITHUB_PR_REF]=${GITHUB_PR_REF}" \
             --form "variables[GITHUB_REPO]=${GITHUB_REPO}" \
-            --form "variables[GITHUB_TOKEN]=${GITHUB_TOKEN}" \
             "${GL_TRIGGER_URL}" > /dev/null
           echo "GitLab pipeline triggered."

gitlab/test.yml

@@ -7,7 +7,7 @@ report_github_status:
     # Only run this job if:
     # 1. The pipeline was started by an API trigger (`CI_PIPELINE_SOURCE == "trigger"`)
     # 2. The required variables from GitHub Actions are present.
-    - if: '$CI_PIPELINE_SOURCE == "trigger" && $GITHUB_PR_SHA && $GITHUB_TOKEN && $GITHUB_REPO && $GITHUB_PR_REF'
+    - if: '$CI_PIPELINE_SOURCE == "trigger" && $GITHUB_PR_SHA && $GH_STATUS_TOKEN && $GITHUB_REPO && $GITHUB_PR_REF'
   before_script:
     # Make sure curl and git are available
     - apk add --no-cache curl git
@@ -16,7 +16,7 @@ report_github_status:
       echo "Reporting pending status to GitHub commit $GITHUB_PR_SHA"
       true || curl --fail --request POST \
         --url "https://api.github.com/repos/${GITHUB_REPO}/statuses/${GITHUB_PR_SHA}" \
-        --header "Authorization: Bearer ${GITHUB_TOKEN}" \
+        --header "Authorization: Bearer ${GH_STATUS_TOKEN}" \
         --header "Accept: application/vnd.github.v3+json" \
         --header "Content-Type: application/json" \
         --data @- <<EOF
@@ -27,7 +27,7 @@ report_github_status:
         "context": "ci/gitlab/pipeline-status"
       }
       EOF
-    - >
+    - |
       docker buildx create \
       --driver=docker-container \
       --name=buildkit-builder \
@@ -37,7 +37,7 @@ report_github_status:
     - git clone -b "$GITHUB_PR_REF" https://github.com/blockstream/esplora.git .
     - cd esplora
     - docker pull "${IMAGE_BASE}:latest-${ARCH}" || true
-    - >
+    - |
       docker buildx build \
         --push \
         --platform "linux/${ARCH}" \
@@ -61,7 +61,7 @@ report_github_status:
       echo "Reporting $FINAL_STATE status to GitHub commit $GITHUB_PR_SHA"
       true || curl --fail --request POST \
         --url "https://api.github.com/repos/${GITHUB_REPO}/statuses/${GITHUB_PR_SHA}" \
-        --header "Authorization: Bearer ${GITHUB_TOKEN}" \
+        --header "Authorization: Bearer ${GH_STATUS_TOKEN}" \
         --header "Accept: application/vnd.github.v3+json" \
         --header "Content-Type: application/json" \
         --data @- << EOF