[MNT] Replace workflow-specific PATs with Neurobagel Bot app (#186)

* Refactored relevant workflows * Added `owner` field to generate token step Co-authored-by: Alyssa Dai <[email protected]> * Removed explicit permissions * Set the GH_TOKEN as env var in one place * Updated the other two workflows --------- Co-authored-by: Alyssa Dai <[email protected]>
neurobagel · Nov 7, 2024 · a901d73 · a901d73
1 parent 5da71c3
commit a901d73
Show file tree

Hide file tree

Showing 3 changed files with 82 additions and 12 deletions.
diff --git a/.github/workflows/label_apply_change.yml b/.github/workflows/label_apply_change.yml
@@ -43,10 +43,24 @@ jobs:
     outputs:
       concl_exist: ${{ steps.missing.outcome }}
     steps:
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ vars.NB_BOT_ID }}
+          private-key: ${{ secrets.NB_BOT_KEY }}
+          # Note: We need to explicitly set the owner field here because this workflow only lives in planning but also 
+          # makes changes in other repos.
+          # See https://github.com/marketplace/actions/create-github-app-token#create-a-token-for-multiple-repositories-in-the-current-owners-installation
+          # and https://github.com/orgs/community/discussions/69154#discussioncomment-7191057
+          owner: ${{ github.repository_owner }}
+
+        # To avoid setting the GH_TOKEN in every step, we set it as an environment variable
+      - name: Set GH_TOKEN
+        run: echo "GH_TOKEN=${{ steps.generate-token.outputs.token }}" >> $GITHUB_ENV
+
       - name: exit 1 if label does not exist
         id: missing
-        env:
-          GH_TOKEN: ${{ secrets.LAB_PAT }}
         # This step makes use of the fact that grep returns a non-zero exit code when no match is found
         # see https://www.gnu.org/software/grep/manual/html_node/Exit-Status.html
         # we use the exit code to encode whether the label exists (see above)
@@ -62,11 +76,26 @@ jobs:
     needs: [check_label]
     if: github.event.action == 'created'
     env:
-        GH_TOKEN: ${{ secrets.LAB_PAT }}
         LABEL_NAME: ${{ github.event.label.name }}
         LABEL_COLOR: ${{ github.event.label.color }}
         LABEL_DESCRIPTION: ${{ github.event.label.description }}
     steps:
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ vars.NB_BOT_ID }}
+          private-key: ${{ secrets.NB_BOT_KEY }}
+          # Note: We need to explicitly set the owner field here because this workflow only lives in planning but also 
+          # makes changes in other repos.
+          # See https://github.com/marketplace/actions/create-github-app-token#create-a-token-for-multiple-repositories-in-the-current-owners-installation
+          # and https://github.com/orgs/community/discussions/69154#discussioncomment-7191057
+          owner: ${{ github.repository_owner }}
+
+        # To avoid setting the GH_TOKEN in every step, we set it as an environment variable
+      - name: Set GH_TOKEN
+        run: echo "GH_TOKEN=${{ steps.generate-token.outputs.token }}" >> $GITHUB_ENV
+
       - if: needs.check_label.outputs.concl_exist == 'success'
         run: |
           echo Cannot create label "${LABEL_NAME}" in "${{ inputs.repo }}" because it already exists
@@ -93,11 +122,26 @@ jobs:
     needs: [check_label]
     if: github.event.action == 'edited'
     env:
-        GH_TOKEN: ${{ secrets.LAB_PAT }}
         LABEL_NAME: ${{ github.event.label.name }}
         LABEL_COLOR: ${{ github.event.label.color }}
         LABEL_DESCRIPTION: ${{ github.event.label.description }}
     steps:
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ vars.NB_BOT_ID }}
+          private-key: ${{ secrets.NB_BOT_KEY }}
+          # Note: We need to explicitly set the owner field here because this workflow only lives in planning but also 
+          # makes changes in other repos.
+          # See https://github.com/marketplace/actions/create-github-app-token#create-a-token-for-multiple-repositories-in-the-current-owners-installation
+          # and https://github.com/orgs/community/discussions/69154#discussioncomment-7191057
+          owner: ${{ github.repository_owner }}
+
+        # To avoid setting the GH_TOKEN in every step, we set it as an environment variable
+      - name: Set GH_TOKEN
+        run: echo "GH_TOKEN=${{ steps.generate-token.outputs.token }}" >> $GITHUB_ENV
+
       - name: label exists
         if: needs.check_label.outputs.concl_exist == 'success'
         run: |
@@ -142,8 +186,4 @@ jobs:
     steps:
       - run: |
           echo action ${{ github.event.action }}
-          echo missing ${{ needs.check_label.outputs.concl_exist }}
-        
-
-          
-
+          echo missing ${{ needs.check_label.outputs.concl_exist }}
diff --git a/.github/workflows/label_sync.yml b/.github/workflows/label_sync.yml
@@ -52,10 +52,25 @@ jobs:
     outputs:
       repos: ${{ steps.get_repo.outputs.repositories }}
     steps:
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ vars.NB_BOT_ID }}
+          private-key: ${{ secrets.NB_BOT_KEY }}
+          # Note: We need to explicitly set the owner field here because this workflow only lives in planning but also 
+          # makes changes in other repos.
+          # See https://github.com/marketplace/actions/create-github-app-token#create-a-token-for-multiple-repositories-in-the-current-owners-installation
+          # and https://github.com/orgs/community/discussions/69154#discussioncomment-7191057
+          owner: ${{ github.repository_owner }}
+
+        # To avoid setting the GH_TOKEN in every step, we set it as an environment variable
+      - name: Set GH_TOKEN
+        run: echo "GH_TOKEN=${{ steps.generate-token.outputs.token }}" >> $GITHUB_ENV
+
       - name: Get current repositories
         id: get_repo
         env:
-          GH_TOKEN: ${{ secrets.LAB_PAT  }}
           MAX_REPO: 50
         run: |
           repo_list=$(gh repo list $GITHUB_REPOSITORY_OWNER --no-archived -L ${MAX_REPO} --json owner,name --jq '.[] | "\(.owner.login)/\(.name)"' | jq -cnR '[inputs | select(length>0)]')

diff --git a/.github/workflows/manual_label_population_to_repos.yml b/.github/workflows/manual_label_population_to_repos.yml
@@ -41,9 +41,8 @@ jobs:
   sync_labels:
     name: Process all the labels
     runs-on: ubuntu-latest
+
     needs: get_labels
-    env:
-      GH_TOKEN: ${{ secrets.LAB_PAT }}
     strategy:
       # Note: we cannot make a matrix for the label AND repo at once,
       # because the total number of jobs will exceed the maximum allowed by GitHub.
@@ -52,6 +51,22 @@ jobs:
       matrix:
         label: ${{fromJSON(needs.get_labels.outputs.labels)}}
     steps:
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ vars.NB_BOT_ID }}
+          private-key: ${{ secrets.NB_BOT_KEY }}
+          # Note: We need to explicitly set the owner field here because this workflow only lives in planning but also 
+          # makes changes in other repos.
+          # See https://github.com/marketplace/actions/create-github-app-token#create-a-token-for-multiple-repositories-in-the-current-owners-installation
+          # and https://github.com/orgs/community/discussions/69154#discussioncomment-7191057
+          owner: ${{ github.repository_owner }}
+
+        # To avoid setting the GH_TOKEN in every step, we set it as an environment variable
+      - name: Set GH_TOKEN
+        run: echo "GH_TOKEN=${{ steps.generate-token.outputs.token }}" >> $GITHUB_ENV
+
       - name: read label details
         id: read_label
         run: |