update app token (#4080)

grafana · Sep 13, 2024 · 8ae5b28 · 8ae5b28
1 parent c0613b6
commit 8ae5b28
Show file tree

Hide file tree

Showing 6 changed files with 52 additions and 10 deletions.
diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
@@ -15,6 +15,13 @@ jobs:
   main:
     runs-on: ubuntu-latest
     steps:
+      - name: Get app token
+        uses: actions/create-github-app-token@v1
+        id: get-github-app-token
+        with:
+          app-id: ${{secrets.APP_ID}}
+          private-key: ${{secrets.APP_PRIVATE_KEY}}
+          owner: ${{ github.repository_owner }}
       - name: Checkout Actions
         uses: actions/checkout@v4
         with:
@@ -28,6 +35,6 @@ jobs:
       - name: Run backport
         uses: ./actions/backport
         with:
-          token: ${{secrets.GITHUB_TOKEN}}
+          token: ${{ steps.get-github-app-token.outputs.token }}
           labelsToAdd: "backport"
           title: "[{{base}}] {{originalTitle}}"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -129,6 +129,14 @@ jobs:
     name: Vendor check
     runs-on: ubuntu-latest
     steps:
+      - name: Get app token
+        uses: actions/create-github-app-token@v1
+        id: get-github-app-token
+        with:
+          app-id: ${{secrets.APP_ID}}
+          private-key: ${{secrets.APP_PRIVATE_KEY}}
+          owner: ${{github.repository_owner}}
+
       - name: Check out code
         uses: actions/checkout@v4
 
@@ -140,7 +148,7 @@ jobs:
       - name: Install Protoc
         uses: arduino/setup-protoc@v3
         with:
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          repo-token: ${{ steps.get-github-app-token.outputs.token }}
 
       - name: Check vendor
         run: make vendor-check

diff --git a/.github/workflows/dependabot_serverless_gomod.yml b/.github/workflows/dependabot_serverless_gomod.yml
@@ -22,23 +22,29 @@ jobs:
         with:
           go-version: 1.22.4
 
+      - name: Get app token
+        uses: actions/create-github-app-token@v1
+        id: get-github-app-token
+        with:
+          app-id: ${{secrets.APP_ID}}
+          private-key: ${{secrets.APP_PRIVATE_KEY}}
+          owner: ${{ github.repository_owner }}
+
       - name: Check out code
         uses: actions/checkout@v4
         with:
           ref: ${{ github.head_ref }}
-          token: ${{ secrets.GH_BOT_ACCESS_TOKEN }}
+          token: ${{ steps.get-github-app-token.outputs.token }}
 
       - name: Update serverless gomod
         run: make -C cmd/tempo-serverless update-mod
 
       - name: Commit serverless gomod changes
         env:
-          USER: grafanabot
-          TOKEN: ${{ secrets.GH_BOT_ACCESS_TOKEN }}
+          USER: x-access-token
+          TOKEN: ${{ steps.get-github-app-token.outputs.token }}
         run: |
           git config --global url."https://${USER}:${TOKEN}@github.com/grafana/tempo".insteadOf "https://github.com/grafana/tempo"
-          git config user.name grafanabot
-          git config user.email [email protected]
           git add cmd/tempo-serverless/lambda/go.mod
           git add cmd/tempo-serverless/lambda/go.sum
           git add cmd/tempo-serverless/cloud-run/go.mod

diff --git a/.github/workflows/doc-validator.yml b/.github/workflows/doc-validator.yml
@@ -9,6 +9,13 @@ jobs:
     container:
       image: "grafana/doc-validator:v5.2.0"
     steps:
+      - name: Get app token
+        uses: actions/create-github-app-token@v1
+        id: get-github-app-token
+        with:
+          app-id: ${{secrets.APP_ID}}
+          private-key: ${{secrets.APP_PRIVATE_KEY}}
+          owner: ${{ github.repository_owner }}
       - name: "Checkout code"
         uses: "actions/checkout@v4"
       - name: "Run doc-validator"
@@ -31,4 +38,4 @@ jobs:
               --name=doc-validator \
               --reporter=github-pr-review
         env:
-          REVIEWDOG_GITHUB_API_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+          REVIEWDOG_GITHUB_API_TOKEN: "${{ steps.get-github-app-token.outputs.token }}"
diff --git a/.github/workflows/metrics-collector.yml b/.github/workflows/metrics-collector.yml
@@ -10,6 +10,13 @@ jobs:
     if: github.repository == 'grafana/tempo'
     runs-on: ubuntu-latest
     steps:
+      - name: Get app token
+        uses: actions/create-github-app-token@v1
+        id: get-github-app-token
+        with:
+          app-id: ${{secrets.APP_ID}}
+          private-key: ${{secrets.APP_PRIVATE_KEY}}
+          owner: ${{ github.repository_owner }}
       - name: Checkout Actions
         uses: actions/checkout@v4
         with:
@@ -22,4 +29,4 @@ jobs:
         uses: ./actions/metrics-collector
         with:
           metricsWriteAPIKey: ${{secrets.GRAFANA_MISC_STATS_API_KEY}}
-          token: ${{secrets.GH_BOT_ACCESS_TOKEN}}
+          token: ${{ steps.get-github-app-token.outputs.token }}
diff --git a/.github/workflows/milestoned_to_project.yml b/.github/workflows/milestoned_to_project.yml
@@ -12,7 +12,14 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      - name: Get app token
+        uses: actions/create-github-app-token@v1
+        id: get-github-app-token
+        with:
+          app-id: ${{secrets.APP_ID}}
+          private-key: ${{secrets.APP_PRIVATE_KEY}}
+          owner: ${{ github.repository_owner }}
       - uses: actions/[email protected]
         with:
           project-url: https://github.com/orgs/grafana/projects/135
-          github-token: ${{ secrets.GH_BOT_ACCESS_TOKEN }}
+          github-token: ${{ steps.get-github-app-token.outputs.token }}