fix: use app token for release

wetransform · Apr 12, 2024 · 063ab9e · 063ab9e
1 parent 5f98ab5
commit 063ab9e
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 3 deletions.
diff --git a/.github/workflows/gradle-library-publish.yml b/.github/workflows/gradle-library-publish.yml
@@ -31,7 +31,8 @@ on:
       WETF_ARTIFACTORY_USER:
       WETF_ARTIFACTORY_PASSWORD:
       SLACK_NOTIFICATIONS_BOT_TOKEN:
-      SEMANTIC_RELEASE_GITHUB_TOKEN:
+      WE_RELEASE_GITHUB_APP_ID:
+      WE_RELEASE_GITHUB_PRIVATE_KEY:
 
 jobs:
   publish:

diff --git a/.github/workflows/gradle-library.yml b/.github/workflows/gradle-library.yml
@@ -71,7 +71,8 @@ on:
       DOCKER_HUB_PASSWORD:
       DOCKER_HUB_EMAIL:
       SLACK_NOTIFICATIONS_BOT_TOKEN:
-      SEMANTIC_RELEASE_GITHUB_TOKEN:
+      WE_RELEASE_GITHUB_APP_ID:
+      WE_RELEASE_GITHUB_PRIVATE_KEY:
 
 jobs:
   run:
@@ -166,14 +167,21 @@ jobs:
       # even if there are open issues from the scan.
       #
 
+      - name: Determine app token for release
+        uses: actions/create-github-app-token@7bfa3a4717ef143a604ee0a99d859b8886a96d00 # v1.9.3
+        id: app-token
+        with:
+          app-id: ${{ secrets.WE_RELEASE_GITHUB_APP_ID }}
+          private-key: "${{ secrets.WE_RELEASE_GITHUB_PRIVATE_KEY }}"
+
       - name: Publish/release with Gradle
         if: ${{ !inputs.skip-build && inputs.publish-tasks != '' }}
         uses: wetransform/gha-gradle-semantic-release@master
         with:
           publish-tasks: ${{ inputs.publish-tasks }}
           release: ${{ inputs.semantic-release }}
           release-dryrun: ${{ inputs.semantic-release-dryrun }}
-          github-token: ${{ secrets.SEMANTIC_RELEASE_GITHUB_TOKEN }}
+          github-token: ${{ steps.app-token.outputs.token }}
         env:
           # For Gradle execution
           ORG_GRADLE_PROJECT_wetfArtifactoryUser: ${{ secrets.WETF_ARTIFACTORY_USER }}