GHA: Use workflow_dispatch (#394)

Author: 9999years

.github/labeler.yml

@@ -1,3 +1,2 @@
-- [ ] Labeled the PR with `patch`, `minor`, or `major` to request a version bump when it's merged.
 - [ ] Updated the user manual in `docs/`.
 - [ ] Added integration / regression tests in `tests/`.

.github/pull_request_template.md

@@ -1,13 +1,14 @@
 ---
 # This workflow runs when PRs are merged and tags/builds/publishes a release.
 
-# Run when PRs to main are closed.
+# Run when PRs to main are closed or when manually triggered.
 on:
   pull_request:
     types:
       - closed
     branches:
       - main
+  workflow_dispatch:
 
 name: Build and publish a release
 
@@ -16,15 +17,17 @@ jobs:
   # workflow on merged PRs.
   if_merged:
     name: Check that PR was merged and not closed
-    if: github.event.pull_request.merged == true
-      && contains(github.event.pull_request.labels.*.name, 'release')
+    if: github.event_name == 'workflow_dispatch'
+      || (github.event.pull_request.merged == true
+        && contains(github.event.pull_request.labels.*.name, 'release'))
     runs-on: ubuntu-latest
     steps:
       - run: |
           echo "This is a canonical hack to run GitHub Actions on merged PRs"
           echo "See: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#running-your-pull_request-workflow-when-a-pull-request-merges"
 
       - name: Comment on PR with link to this action
+        if: github.event_name == 'pull_request'
         uses: peter-evans/create-or-update-comment@67dcc547d311b736a8e6c5c236542148a47adc3d # v2.1.1
         with:
           issue-number: ${{ github.event.pull_request.number }}
@@ -66,6 +69,9 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest]
+    environment: release
+    permissions:
+      id-token: write # See: rust-lang/crates-io-auth-action
     steps:
       - name: Checkout code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -145,10 +151,13 @@ jobs:
             target/ghciwatch-aarch64-linux
             target/ghciwatch-user-manual.tar.xz
 
+      - uses: rust-lang/crates-io-auth-action@v1
+        id: auth
+
       - name: Publish to crates.io
         if: runner.os == 'Linux'
         env:
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
         run: |
           nix run .#cargo -- publish --no-verify
 
@@ -159,12 +168,24 @@ jobs:
       - if_merged
       - build
       - version
+    environment: release
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
     steps:
+      # See: https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#authenticating-with-github-app-generated-tokens
+      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+        id: generate_token
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
       - name: Tag the release
         uses: mathieudutour/github-tag-action@d745f2e74aaf1ee82e747b181f7a0967978abee0 # v6.0
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          commit_sha: ${{ github.event.pull_request.merge_commit_sha }}
+          github_token: ${{ steps.generate_token.outputs.token }}
+          commit_sha: ${{ github.sha }}
           custom_tag: ${{ needs.version.outputs.version }}
 
       - name: Download artifacts
@@ -185,9 +206,8 @@ jobs:
       - name: Create release
         id: create_release
         uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v0.1.15
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
+          token: ${{ steps.generate_token.outputs.token }}
           draft: false
           prerelease: false
           generate_release_notes: true
@@ -199,8 +219,10 @@ jobs:
             linux/ghciwatch-user-manual.tar.xz
 
       - name: Comment on PR with link to the release
+        if: github.event_name == 'pull_request'
         uses: peter-evans/create-or-update-comment@67dcc547d311b736a8e6c5c236542148a47adc3d # v2.1.1
         with:
+          token: ${{ steps.generate_token.outputs.token }}
           issue-number: ${{ github.event.pull_request.number }}
           body: |
             [Release ${{ needs.version.outputs.version }}][release] was built and published successfully!

.github/workflows/label-prs.yaml

@@ -1,67 +1,34 @@
 ---
-# This workflow runs when PRs labeled `major`, `minor`, or `patch` are closed
-# and increments version numbers. Then, it opens a PR labeled `release` for the
-# changes. When that PR is merged, a release is created (see `release.yaml`).
-#
-# Are you here because I left Mercury and now my personal access token is
-# invalid for workflows, breaking CI? You'll want to go to
-#     https://github.com/MercuryTechnologies/ghciwatch/settings/secrets/actions
-# and update the `REPO_GITHUB_TOKEN` secret to a new, valid token.
-
+# This workflow is triggered manually to increment version numbers and open a
+# release PR. When that PR is merged, a release is created (see `release.yaml`).
 on:
-  pull_request_target:
-    types:
-      - closed
-    branches:
-      - main
+  workflow_dispatch:
+    inputs:
+      bump_type:
+        description: Version bump type
+        required: true
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
+        default: patch
 
 name: Update versions and create release PR
 
 jobs:
-  # We make `if_merged` a `needs:` of the other jobs here to only run this
-  # workflow on merged PRs.
-  if_merged:
-    name: Check that PR was merged and not closed
-    if: github.event.pull_request.merged == true
-      && ( contains(github.event.pull_request.labels.*.name, 'major')
-        || contains(github.event.pull_request.labels.*.name, 'minor')
-        || contains(github.event.pull_request.labels.*.name, 'patch')
-      )
-    runs-on: ubuntu-latest
-    steps:
-      - run: |
-          echo "This is a canonical hack to run GitHub Actions on merged PRs"
-          echo "See: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#running-your-pull_request-workflow-when-a-pull-request-merges"
-
-  bump_type:
-    name: Determine version bump type
-    needs: if_merged
-    runs-on: ubuntu-latest
-    outputs:
-      bump_type: ${{ steps.bump_type.outputs.bump_type }}
-    steps:
-      - name: Set output
-        id: bump_type
-        env:
-          is_major: ${{ contains(github.event.pull_request.labels.*.name, 'major') }}
-          is_minor: ${{ contains(github.event.pull_request.labels.*.name, 'minor') }}
-          is_patch: ${{ contains(github.event.pull_request.labels.*.name, 'patch') }}
-        run: |
-          if [[ "$is_major" == "true" ]]; then
-            echo "bump_type=major" >> "$GITHUB_OUTPUT"
-          elif [[ "$is_minor" == "true" ]]; then
-            echo "bump_type=minor" >> "$GITHUB_OUTPUT"
-          elif [[ "$is_patch" == "true" ]]; then
-            echo "bump_type=patch" >> "$GITHUB_OUTPUT"
-          fi
-
   version:
     name: Bump version and create release PR
-    needs:
-      - if_merged
-      - bump_type
     runs-on: ubuntu-latest
+    environment: version-bump
     steps:
+      # See: https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#authenticating-with-github-app-generated-tokens
+      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+        id: generate_token
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
       - name: Checkout
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
@@ -80,7 +47,7 @@ jobs:
         run: echo "version=$(nix run .#get-crate-version)" >> "$GITHUB_OUTPUT"
 
       - name: Increment `Cargo.toml` version
-        run: nix run .#make-release-commit -- ${{ needs.bump_type.outputs.bump_type }}
+        run: nix run .#make-release-commit -- ${{ inputs.bump_type }}
 
       - name: Get new version number
         id: new_cargo_metadata
@@ -90,17 +57,10 @@ jobs:
         id: release_pr
         uses: peter-evans/create-pull-request@4e1beaa7521e8b457b572c090b25bd3db56bf1c5 # v5.0.3
         with:
-          # We push with the repo-scoped GitHub token to avoid branch
-          # protections. This token is tied to my account (@9999years) which is
-          # excluded from branch protection restrictions.
-          #
-          # I'd love a better way of implementing this but GitHub doesn't have
-          # one: https://github.com/github-community/community/discussions/13836
-          #
-          # Also, PRs created with the default `secrets.GITHUB_TOKEN` won't
+          # PRs created with the default `secrets.GITHUB_TOKEN` won't
           # trigger `pull_request` workflows, so regular CI won't run either.
           # See: https://github.com/orgs/community/discussions/65321
-          token: ${{ secrets.REPO_GITHUB_TOKEN }}
+          token: ${{ steps.generate_token.outputs.token }}
           branch: release/${{ steps.new_cargo_metadata.outputs.version }}
           delete-branch: true
           base: main
@@ -109,12 +69,3 @@ jobs:
             Update version to ${{ steps.new_cargo_metadata.outputs.version }} with [cargo-release](https://github.com/crate-ci/cargo-release).
             Merge this PR to build and publish a new release.
           labels: release
-
-      - name: Comment on PR with link to release PR
-        uses: peter-evans/create-or-update-comment@67dcc547d311b736a8e6c5c236542148a47adc3d # v2.1.1
-        with:
-          issue-number: ${{ github.event.pull_request.number }}
-          body: |
-            [A PR to release these changes has been created, bumping the version from ${{ steps.old_cargo_metadata.outputs.version }} to ${{ steps.new_cargo_metadata.outputs.version }}.][pr]
-
-            [pr]: ${{ steps.release_pr.outputs.pull-request-url }}