Merge pull request #77 from amblelabs/ci/fix-changelog-token

ci: fix changelog workflow auth and push target

Author: duzos

.github/workflows/append_changelog.yml

@@ -11,9 +11,16 @@ on:
         required: false
         default: ''
 
+concurrency:
+  group: append-changelog
+  cancel-in-progress: false
+
 jobs:
   append-changelog:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: read
     # only proceed if merge event or manual run
     if: |
       (github.event_name == 'pull_request' && github.event.pull_request.merged == true) ||
@@ -23,7 +30,8 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.BOT_TOKEN }}
+          ref: master
+          token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Python
         uses: actions/setup-python@v4
@@ -36,17 +44,19 @@ jobs:
       - name: Run changelog updater
         env:
           GITHUB_REPOSITORY: ${{ github.repository }}
-          BOT_TOKEN: ${{ secrets.BOT_TOKEN }}
+          BOT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITHUB_EVENT_PATH: ${{ github.event_path }}
         run: |
           python scripts/update_changelog.py \
             --pr-numbers "${{ github.event.inputs.pr_numbers }}"
       - name: Commit & push
-        env:
-          TOKEN: ${{ secrets.BOT_TOKEN }}
         run: |
-          git config user.name "github-bot"
-          git config user.email "bot@users.noreply.github.com"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git add CHANGELOG.md
+          if git diff --cached --quiet; then
+            echo "No changelog changes to commit."
+            exit 0
+          fi
           git commit -m "docs: update CHANGELOG"
-          git push https://x-access-token:${TOKEN}@github.com/${{ github.repository }} HEAD:${{ github.ref }}
+          git push origin HEAD:master