ci: only use GitHub action tokens when needed (#680)

EX-6308
empathyco · Aug 29, 2022 · 21f668c · 21f668c
1 parent d5e40e1
commit 21f668c
Show file tree

Hide file tree

Showing 5 changed files with 23 additions and 16 deletions.
diff --git a/.github/actions/release-alpha/action.yml b/.github/actions/release-alpha/action.yml
@@ -1,8 +1,11 @@
 name: Release alpha version
 description: Runs npm script to release alpha version and pushes tags to github
 inputs:
-  npm-token:
-    description: Token to push code with
+  npm_token:
+    description: Token to push code to npm
+    required: true
+  github_token:
+    description: Token to push code to github
     required: true
 runs:
   using: "composite"
@@ -16,10 +19,13 @@ runs:
       run: echo //registry.npmjs.org/:_authToken=${NPM_TOKEN} > .npmrc
       shell: bash
       env:
-        NPM_TOKEN: ${{ inputs.npm-token }}
+        NPM_TOKEN: ${{ inputs.npm_token }}
     - name: Publish release
       run: npm run release:alpha
       shell: bash
-    - name: Push changes to GitHub
-      run: git push --follow-tags
-      shell: bash
+    - name: Push tags
+      uses: ad-m/github-push-action@master
+      with:
+        github_token: ${{ inputs.github_token }}
+        branch: ${{ github.ref }}
+        tags: true
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -8,10 +8,10 @@ jobs:
     runs-on: ubuntu-latest
     container: cypress/browsers:node14.17.0-chrome91-ff89
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           fetch-depth: 0
-          token: ${{ secrets.SUPPORT_TOKEN }}
+          persist-credentials: false
       - name: Install lerna and all packages
         run: npm ci
       - name: Run linter in all packages
@@ -22,5 +22,6 @@ jobs:
         if: ${{ github.ref_name == 'main' && github.actor != 'support-empathy' && !startsWith(github.event.head_commit.message, 'chore(release):') }}
         uses: ./.github/actions/release-alpha
         with:
-          npm-token: ${{ secrets.NPM_TOKEN }}
+          npm_token: ${{ secrets.NPM_TOKEN }}
+          github_token: ${{ secrets.SUPPORT_TOKEN }}
 
diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml
@@ -5,9 +5,8 @@ jobs:
     runs-on: ubuntu-latest
     container: cypress/browsers:node14.17.0-chrome91-ff89
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
-          token: ${{ secrets.SUPPORT_TOKEN }}
           fetch-depth: 0
       - name: Install lerna and all packages
         run: npm ci

diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
@@ -9,10 +9,10 @@ jobs:
     runs-on: ubuntu-latest
     container: cypress/browsers:node14.17.0-chrome91-ff89
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
-          token: ${{ secrets.SUPPORT_TOKEN }}
           fetch-depth: 0
+          persist-credentials: false
       - name: Install lerna and all packages
         run: npm ci
       - name: Run linter in all packages

diff --git a/.github/workflows/release-alpha.yml b/.github/workflows/release-alpha.yml
@@ -5,10 +5,10 @@ jobs:
     runs-on: ubuntu-latest
     container: cypress/browsers:node14.17.0-chrome91-ff89
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           fetch-depth: 0
-          token: ${{ secrets.SUPPORT_TOKEN }}
+          persist-credentials: false
       - name: Install lerna and all packages
         run: npm ci
       - name: Run linter in all packages
@@ -18,4 +18,5 @@ jobs:
       - name: Call release alpha action
         uses: ./.github/actions/release-alpha
         with:
-          npm-token: ${{ secrets.NPM_TOKEN }}
+          npm_token: ${{ secrets.NPM_TOKEN }}
+          github_token: ${{ secrets.SUPPORT_TOKEN }}