Fix dispatch script

packages/commonwealth/package.json

@@ -217,6 +217,7 @@
     "node-jose": "^2.2.0",
     "node-object-hash": "^3.0.0",
     "numeral": "^2.0.6",
+    "octokit": "^4.0.2",
     "openai": "^4.0.0",
     "os-browserify": "^0.3.0",
     "parchment": "^1.1.4",

packages/commonwealth/server/config.ts

@@ -23,7 +23,8 @@ const {
   CF_ZONE_ID,
   CF_API_KEY,
   LIBP2P_PRIVATE_KEY,
-  API_CLIENT_REPO_TOKEN,
+  DISPATCHER_APP_ID,
+  DISPATCHER_APP_PRIVATE_KEY,
 } = process.env;
 
 const NO_PRERENDER = _NO_PRERENDER;
@@ -99,7 +100,10 @@ export const config = configure(
     LIBP2P_PRIVATE_KEY,
     SNAPSHOT_WEBHOOK_SECRET,
     GITHUB: {
-      API_CLIENT_REPO_TOKEN,
+      DISPATCHER_APP_ID: DISPATCHER_APP_ID
+        ? parseInt(DISPATCHER_APP_ID)
+        : undefined,
+      DISPATCHER_APP_PRIVATE_KEY,
     },
   },
   z.object({
@@ -170,12 +174,17 @@ export const config = configure(
         'SNAPSHOT_WEBHOOK_SECRET is required in public environments',
       ),
     GITHUB: z.object({
-      API_CLIENT_REPO_TOKEN: z
+      DISPATCHER_APP_ID: z
+        .number()
+        .optional()
+        .refine((data) => !(model_config.APP_ENV === 'production' && !data))
+        .describe('The ID of the Common Workflow Dispatcher GitHub app'),
+      DISPATCHER_APP_PRIVATE_KEY: z
         .string()
         .optional()
         .refine((data) => !(model_config.APP_ENV === 'production' && !data))
         .describe(
-          'A token used to authenticate with the GitHub API. Primarily used to trigger workflows',
+          'The private key of the Common Workflow Dispatcher GitHub app',
         ),
     }),
   }),

packages/commonwealth/server/util/dispatchSDKPublishWorkflow.ts

@@ -1,6 +1,7 @@
 import { logger } from '@hicommonwealth/core';
 import { readFileSync } from 'fs';
 import fetch from 'node-fetch';
+import { App } from 'octokit';
 import path, { dirname } from 'path';
 import { fileURLToPath } from 'url';
 import { config } from '../config';
@@ -12,11 +13,33 @@ const externalApiConfig = JSON.parse(
   readFileSync(path.join(__dirname, '../external-api-config.json'), 'utf8'),
 );
 
-const API_CLIENT_GH_ORG = 'hicommonwealth';
-const API_CLIENT_GH_REPO = 'api-client';
-const API_CLIENT_PUBLISH_WORKFLOW_FILE_NAME = 'publish.yml';
+const owner = 'hicommonwealth';
+const repo = 'common-api-fern-config';
+const workflow_id = 'publish.yml';
 const API_CLIENT_NPM_NAME = '@commonxyz/api-client';
 
+export async function getOctokit() {
+  if (
+    !config.GITHUB.DISPATCHER_APP_ID ||
+    !config.GITHUB.DISPATCHER_APP_PRIVATE_KEY
+  ) {
+    log.error('Missing GitHub app credentials');
+    return;
+  }
+  const app = new App({
+    appId: config.GITHUB.DISPATCHER_APP_ID,
+    privateKey: config.GITHUB.DISPATCHER_APP_PRIVATE_KEY,
+  });
+
+  // https://docs.github.com/en/rest/apps/apps?#get-a-repository-installation-for-the-authenticated-app
+  const { data: installation } = await app.octokit.request(
+    `GET /repos/{owner}/{repo}/installation`,
+    { owner, repo },
+  );
+
+  return app.getInstallationOctokit(installation.id);
+}
+
 export async function dispatchSDKPublishWorkflow() {
   let currentVersionNPM: string | undefined = undefined;
 
@@ -50,33 +73,26 @@ export async function dispatchSDKPublishWorkflow() {
     return;
   }
 
-  const url =
-    `https://api.github.com/repos/${API_CLIENT_GH_ORG}/${API_CLIENT_GH_REPO}` +
-    `/actions/workflows/${API_CLIENT_PUBLISH_WORKFLOW_FILE_NAME}/dispatches`;
-
-  const data = {
-    ref: 'main',
-    inputs: {
-      version: externalApiConfig.version,
-    },
-  };
+  const url = `/repos/{owner}/{repo}/actions/workflows/{workflow_id}/dispatches`;
 
   try {
-    const response = await fetch(url, {
-      method: 'POST',
+    const octokit = await getOctokit();
+    if (!octokit) return;
+    const res = await octokit.request(`POST ${url}`, {
+      owner,
+      repo,
+      workflow_id,
+      ref: 'main',
+      inputs: {
+        version: externalApiConfig.version,
+      },
       headers: {
-        Accept: 'application/vnd.github+json',
-        Authorization: `Bearer ${config.GITHUB.API_CLIENT_REPO_TOKEN}`,
         'X-GitHub-Api-Version': '2022-11-28',
-        'Content-Type': 'application/json',
       },
-      body: JSON.stringify(data),
     });
 
-    if (response.status !== 204) {
-      log.fatal(
-        `Failed to dispatch workflow: ${response.status} - ${response.statusText}`,
-      );
+    if (res.status !== 204) {
+      log.fatal(`Failed to dispatch workflow: ${res.status}`);
     } else {
       log.info('Workflow dispatched successfully');
     }