Skip to content

Commit 05508a5

Browse files
DmitriyLewenDmitriyLewen
committed
ci: migrate TRIVY_REPO_TOKEN to GitHub App token
1 parent 0d0fac6 commit 05508a5

3 files changed

Lines changed: 54 additions & 10 deletions

File tree

‎.github/workflows/backport.yaml‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,11 +34,21 @@ jobs:
3434
startsWith(github.event.comment.body, '@aqua-bot backport release/')
3535
runs-on: ubuntu-2404-2core
3636
steps:
37+
# GITHUB_TOKEN cannot trigger workflows on PRs it creates, so the backport
38+
# PR would not run CI — generate a GitHub App installation token instead.
39+
- name: Generate token
40+
id: app-token
41+
uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
42+
with:
43+
client-id: ${{ secrets.REPO_TRIVY_WRITE_GH_APP_CLIENT_ID }}
44+
private-key: ${{ secrets.REPO_TRIVY_WRITE_GH_APP_PRIVATE_KEY }}
45+
3746
- name: Checkout repository
3847
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3948
with:
4049
fetch-depth: 0
4150
persist-credentials: true # backport.sh runs git push
51+
token: ${{ steps.app-token.outputs.token }}
4252

4353
- name: Extract branch name
4454
env:
@@ -58,8 +68,6 @@ jobs:
5868
5969
- name: Run backport script
6070
env:
61-
# Use TRIVY_REPO_TOKEN instead of GITHUB_TOKEN
62-
# This allows the created PR to trigger tests and other workflows
63-
GITHUB_TOKEN: ${{ secrets.TRIVY_REPO_TOKEN }}
71+
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
6472
ISSUE_NUMBER: ${{ github.event.issue.number }}
6573
run: ./misc/backport/backport.sh "$BRANCH_NAME" "$ISSUE_NUMBER"

‎.github/workflows/release-please.yaml‎

Lines changed: 32 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,27 +17,45 @@ jobs:
1717
runs-on: ubuntu-2404-2core
1818
if: ${{ !startsWith(github.event.head_commit.message, 'release:') && !github.event.inputs.version }}
1919
steps:
20+
# GITHUB_TOKEN cannot trigger workflows on PRs it creates, so the release PR
21+
# would not run CI — generate a GitHub App installation token instead.
22+
- name: Generate token
23+
id: app-token
24+
uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
25+
with:
26+
client-id: ${{ secrets.REPO_TRIVY_WRITE_GH_APP_CLIENT_ID }}
27+
private-key: ${{ secrets.REPO_TRIVY_WRITE_GH_APP_PRIVATE_KEY }}
28+
2029
- name: Release Please
2130
id: release
2231
uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0
2332
with:
24-
token: ${{ secrets.TRIVY_REPO_TOKEN }}
33+
token: ${{ steps.app-token.outputs.token }}
2534
target-branch: ${{ github.ref_name }}
2635

2736
manual-release-please:
2837
runs-on: ubuntu-2404-2core
2938
if: ${{ github.event.inputs.version }}
3039
steps:
40+
# GITHUB_TOKEN cannot trigger workflows on PRs it creates, so the release PR
41+
# would not run CI — generate a GitHub App installation token instead.
42+
- name: Generate token
43+
id: app-token
44+
uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
45+
with:
46+
client-id: ${{ secrets.REPO_TRIVY_WRITE_GH_APP_CLIENT_ID }}
47+
private-key: ${{ secrets.REPO_TRIVY_WRITE_GH_APP_PRIVATE_KEY }}
48+
3149
- name: Install Release Please CLI
3250
run: npm install release-please -g
3351

3452
- name: Release Please
3553
env:
3654
RELEASE_VERSION: ${{ github.event.inputs.version }}
37-
TRIVY_REPO_TOKEN: ${{ secrets.TRIVY_REPO_TOKEN }}
55+
APP_TOKEN: ${{ steps.app-token.outputs.token }}
3856
run: |
3957
release-please release-pr --repo-url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" \
40-
--token="$TRIVY_REPO_TOKEN" \
58+
--token="$APP_TOKEN" \
4159
--release-as="$RELEASE_VERSION" \
4260
--target-branch="$GITHUB_REF_NAME"
4361
@@ -57,13 +75,23 @@ jobs:
5775
echo "pr_number=$( echo "$COMMIT_MESSAGE" | sed 's/.*(\#\([0-9]\+\)).*$/\1/' )" >> $GITHUB_OUTPUT
5876
echo "release_branch=release/v$( echo "$COMMIT_MESSAGE" | sed 's/^release: v\([0-9]\+\.[0-9]\+\).*$/\1/' )" >> $GITHUB_OUTPUT
5977
78+
# GITHUB_TOKEN cannot trigger the release workflow on the created tag —
79+
# generate a GitHub App installation token instead.
80+
- name: Generate token
81+
id: app-token
82+
if: ${{ steps.extract_info.outputs.version }}
83+
uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
84+
with:
85+
client-id: ${{ secrets.REPO_TRIVY_WRITE_GH_APP_CLIENT_ID }}
86+
private-key: ${{ secrets.REPO_TRIVY_WRITE_GH_APP_PRIVATE_KEY }}
87+
6088
- name: Tag release
6189
if: ${{ steps.extract_info.outputs.version }}
6290
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
6391
env:
6492
VERSION: ${{ steps.extract_info.outputs.version }}
6593
with:
66-
github-token: ${{ secrets.TRIVY_REPO_TOKEN }} # To trigger another workflow
94+
github-token: ${{ steps.app-token.outputs.token }} # To trigger another workflow
6795
script: |
6896
await github.rest.git.createRef({
6997
owner: context.repo.owner,

‎.github/workflows/release.yaml‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -48,11 +48,21 @@ jobs:
4848
needs: release
4949
runs-on: ubuntu-2404-2core
5050
steps:
51+
# GITHUB_TOKEN cannot trigger workflows on PRs it creates, so the chart
52+
# version PR would not run CI — generate a GitHub App installation token instead.
53+
- name: Generate token
54+
id: app-token
55+
uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
56+
with:
57+
client-id: ${{ secrets.REPO_TRIVY_WRITE_GH_APP_CLIENT_ID }}
58+
private-key: ${{ secrets.REPO_TRIVY_WRITE_GH_APP_PRIVATE_KEY }}
59+
5160
- name: Checkout
5261
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5362
with:
5463
fetch-depth: 0
5564
persist-credentials: true # mage helm:updateVersion runs git push
65+
token: ${{ steps.app-token.outputs.token }}
5666

5767
- name: Set up Git user
5868
run: |
@@ -68,9 +78,7 @@ jobs:
6878
- name: Create a PR with Trivy version
6979
run: mage helm:updateVersion
7080
env:
71-
# Use TRIVY_REPO_TOKEN instead of GITHUB_TOKEN
72-
# This allows the created PR to trigger tests and other workflows
73-
GITHUB_TOKEN: ${{ secrets.TRIVY_REPO_TOKEN }}
81+
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
7482

7583
# `trigger-version-update` triggers workflows in the `aqua` repositories to update the Trivy version.
7684
trigger-version-update:

0 commit comments

Comments
 (0)