ci: Updated deployment to use a GitHub App instead of a PAT. (#68)

Author: jamesiarmes

.github/workflows/deploy-to-staging.yml

@@ -8,21 +8,22 @@ on:
 jobs:
   ci:
     uses: ./.github/workflows/ci.yml
+    
   deploy:
     name: Deploy to Staging
     environment: staging
     runs-on: ubuntu-latest
     env:
       ECR_REPOSITORY: work-requirements-self-advocacy-tool-staging-web
       IMAGE_TAG: ${{ github.sha }}
-      BUNDLE_GITHUB__COM: ${{ secrets.DEPLOY_PAT }}
+      INFRA_REPO: work-requirements-self-advocacy-tool-infra
 
     steps:
       - name: Check out code
         uses: actions/checkout@v6
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v5
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -45,13 +46,21 @@ jobs:
             --name  /work-requirements-self-advocacy-tool/staging/web/version \
             --value "$IMAGE_TAG" \
             --overwrite
+      - name: Get a deployment token
+        uses: actions/create-github-app-token@v2
+        id: token
+        with:
+          app-id: ${{ secrets.DEPLOYMENT_APP_ID }}
+          private-key: ${{ secrets.DEPLOYMENT_APP_KEY }}
+          owner: codeforamerica
+          repositories: ${{ env.INFRA_REPO }}
       - name: Trigger deployment from work requirements self advocacy infra
-        uses: codex-/return-dispatch@v2
+        uses: codex-/return-dispatch@v3
         id: dispatch
         with:
-          token: ${{ secrets.DEPLOY_PAT }}
+          token: ${{ steps.token.outputs.token }}
           ref: 'main'
-          repo: work-requirements-self-advocacy-tool-infra
+          repo: ${{ env.INFRA_REPO }}
           owner: codeforamerica
           workflow: 'deploy.yml'
           workflow_inputs: |
@@ -63,12 +72,12 @@ jobs:
         uses: lucasssvaz/wait-on-workflow@v1
         id: waiter
         with:
-          github-token: ${{ secrets.DEPLOY_PAT }}
-          repository: codeforamerica/work-requirements-self-advocacy-tool-infra
+          github-token: ${{ steps.token.outputs.token }}
+          repository: codeforamerica/${{ env.INFRA_REPO }}
           workflow: ${{ steps.dispatch.outputs.run_id }}
       - name: Fail unless the workflow succeeded
         if: ${{ steps.waiter.outputs.conclusion != 'success' }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             core.setFailed('Deployment workflow completed with stats: ${{ steps.waiter.outputs.conclusion }}')