issue_commands.yml

name: Run commands when issues are labeled
on:
  issues:
    types: [labeled, unlabeled]
permissions: {}
jobs:
  main:
    permissions:
      contents: read
      id-token: write # The "id-token: write" permission is required by "get-vault-secrets" action
      issues: write
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Actions
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          repository: 'grafana/grafana-github-actions'
          path: ./actions
          ref: main
          persist-credentials: false
      - name: Install Actions
        run: npm install --production --prefix ./actions
      - name: Get secrets from vault
        id: get-secrets
        uses: grafana/shared-workflows/actions/get-vault-secrets@main
        with:
          repo_secrets: |
            AWS_DS_TOKEN_CREATOR_ID=aws-ds-token-creator:app_id
            AWS_DS_TOKEN_CREATOR_PEM=aws-ds-token-creator:pem
      - name: 'Generate token'
        id: generate_token
        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3
        with:
          app-id: ${{ env.AWS_DS_TOKEN_CREATOR_ID }}
          private-key: ${{ env.AWS_DS_TOKEN_CREATOR_PEM }}
      - name: Run Commands
        uses: ./actions/commands
        with:
          token: ${{ steps.generate_token.outputs.token }}
          configPath: issue_commands