Dung PAT rieng cho GitHub admin actions

Author: TUPM96

.github/workflows/deploy.yml

@@ -146,7 +146,7 @@ jobs:
           ADMIN_PASSWORD: ${{ secrets.ADMIN_PASSWORD }}
           DEV_PAYMENT_ENABLED: ${{ secrets.DEV_PAYMENT_ENABLED }}
           DEV_PAYMENT_CODE: ${{ secrets.DEV_PAYMENT_CODE }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          MERGEOS_GITHUB_TOKEN: ${{ secrets.MERGEOS_GITHUB_TOKEN }}
           GITHUB_OWNER: ${{ secrets.GITHUB_OWNER }}
           GITHUB_OWNER_TYPE: ${{ secrets.GITHUB_OWNER_TYPE }}
           MERGEOS_GITHUB_OAUTH_CLIENT_ID: ${{ secrets.MERGEOS_GITHUB_OAUTH_CLIENT_ID }}
@@ -156,7 +156,7 @@ jobs:
           username: ${{ secrets.DEPLOY_USER }}
           password: ${{ secrets.DEPLOY_PASSWORD }}
           port: ${{ secrets.DEPLOY_PORT }}
-          envs: DEPLOY_PATH,ADMIN_EMAIL,ADMIN_PASSWORD,DEV_PAYMENT_ENABLED,DEV_PAYMENT_CODE,GITHUB_TOKEN,GITHUB_OWNER,GITHUB_OWNER_TYPE,MERGEOS_GITHUB_OAUTH_CLIENT_ID,MERGEOS_GITHUB_OAUTH_CLIENT_SECRET
+          envs: DEPLOY_PATH,ADMIN_EMAIL,ADMIN_PASSWORD,DEV_PAYMENT_ENABLED,DEV_PAYMENT_CODE,MERGEOS_GITHUB_TOKEN,GITHUB_OWNER,GITHUB_OWNER_TYPE,MERGEOS_GITHUB_OAUTH_CLIENT_ID,MERGEOS_GITHUB_OAUTH_CLIENT_SECRET
           script: |
             set -e
             APP_DIR="${DEPLOY_PATH:-$HOME/mergeos}"
@@ -244,7 +244,7 @@ jobs:
             Environment=ADMIN_PASSWORD=$ADMIN_PASSWORD
             Environment=DEV_PAYMENT_ENABLED=$DEV_PAYMENT_ENABLED
             Environment=DEV_PAYMENT_CODE=$DEV_PAYMENT_CODE
-            Environment=GITHUB_TOKEN=$GITHUB_TOKEN
+            Environment=GITHUB_TOKEN=$MERGEOS_GITHUB_TOKEN
             Environment=GITHUB_OWNER=$GITHUB_OWNER
             Environment=GITHUB_OWNER_TYPE=$GITHUB_OWNER_TYPE
             Environment=GITHUB_OAUTH_CLIENT_ID=$MERGEOS_GITHUB_OAUTH_CLIENT_ID
@@ -262,7 +262,7 @@ jobs:
               systemctl --user is-active --quiet mergeos.service
             else
               pkill -f "$APP_DIR/mergeos" || true
-              MERGEOS_ENV=production PORT=8080 DATABASE_URL="$DATABASE_URL_VALUE" ADMIN_EMAIL="$ADMIN_EMAIL" ADMIN_PASSWORD="$ADMIN_PASSWORD" DEV_PAYMENT_ENABLED="$DEV_PAYMENT_ENABLED" DEV_PAYMENT_CODE="$DEV_PAYMENT_CODE" GITHUB_TOKEN="$GITHUB_TOKEN" GITHUB_OWNER="$GITHUB_OWNER" GITHUB_OWNER_TYPE="$GITHUB_OWNER_TYPE" GITHUB_OAUTH_CLIENT_ID="$MERGEOS_GITHUB_OAUTH_CLIENT_ID" GITHUB_OAUTH_CLIENT_SECRET="$MERGEOS_GITHUB_OAUTH_CLIENT_SECRET" nohup "$APP_DIR/mergeos" > "$APP_DIR/mergeos.log" 2> "$APP_DIR/mergeos.err.log" &
+              MERGEOS_ENV=production PORT=8080 DATABASE_URL="$DATABASE_URL_VALUE" ADMIN_EMAIL="$ADMIN_EMAIL" ADMIN_PASSWORD="$ADMIN_PASSWORD" DEV_PAYMENT_ENABLED="$DEV_PAYMENT_ENABLED" DEV_PAYMENT_CODE="$DEV_PAYMENT_CODE" GITHUB_TOKEN="$MERGEOS_GITHUB_TOKEN" GITHUB_OWNER="$GITHUB_OWNER" GITHUB_OWNER_TYPE="$GITHUB_OWNER_TYPE" GITHUB_OAUTH_CLIENT_ID="$MERGEOS_GITHUB_OAUTH_CLIENT_ID" GITHUB_OAUTH_CLIENT_SECRET="$MERGEOS_GITHUB_OAUTH_CLIENT_SECRET" nohup "$APP_DIR/mergeos" > "$APP_DIR/mergeos.log" 2> "$APP_DIR/mergeos.err.log" &
             fi
             if command -v sudo >/dev/null 2>&1; then
               NODE_MAJOR=22

README.md

@@ -252,7 +252,8 @@ Important backend variables:
 - `DEV_PAYMENT_ENABLED` and `DEV_PAYMENT_CODE`: local verifier
 - `PAYPAL_ENV`, `PAYPAL_CLIENT_ID`, `PAYPAL_CLIENT_SECRET`: PayPal Orders v2
 - `CRYPTO_RPC_URL`, `CRYPTO_RECEIVER`, `CRYPTO_ASSET`, `CRYPTO_TOKEN_CONTRACT`: crypto verifier
-- `GITHUB_TOKEN`, `GITHUB_OWNER`, `GITHUB_OWNER_TYPE`: GitHub bounty repo creation
+- `GITHUB_TOKEN`, `GITHUB_OWNER`, `GITHUB_OWNER_TYPE`: backend runtime values for GitHub bounty repo creation and admin PR merge actions
+- `MERGEOS_GITHUB_TOKEN`: Docker Compose and GitHub Actions secret name that maps into backend `GITHUB_TOKEN`; use a personal access token with repo write access, not the automatic GitHub Actions token
 - `GITHUB_OAUTH_CLIENT_ID`, `GITHUB_OAUTH_CLIENT_SECRET`: backend runtime values for GitHub login and MRG wallet linking
 - `MERGEOS_GITHUB_OAUTH_CLIENT_ID`, `MERGEOS_GITHUB_OAUTH_CLIENT_SECRET`: Docker Compose and GitHub Actions secret names that map into the backend runtime values
 - `BOUNTY_ROOT`: local child bounty repo root

docker-compose.yml

@@ -40,6 +40,7 @@ services:
       CRYPTO_ASSET: erc20
       CRYPTO_TOKEN_DECIMALS: "6"
       CRYPTO_MIN_CONFIRMATIONS: "1"
+      GITHUB_TOKEN: ${MERGEOS_GITHUB_TOKEN:-}
       GITHUB_OWNER: mergeos-bounties
       GITHUB_OWNER_TYPE: org
       GITHUB_OAUTH_CLIENT_ID: ${MERGEOS_GITHUB_OAUTH_CLIENT_ID:-}