Use Github App for retrieving job token

mattermost · Nov 27, 2023 · eb9b93e · eb9b93e
1 parent 3684cff
commit eb9b93e
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 3 deletions.
diff --git a/.github/workflows/bump-build-number.yml b/.github/workflows/bump-build-number.yml
@@ -15,6 +15,13 @@ jobs:
     # This is required to run on MacOS
     runs-on: macos-12
     steps:
+    - uses: mattermost/github-app-installation-token-action@181cd1b8c94b158428c4facfe043d6e28c20be55
+      id: ghapp
+      with:
+        appId: "${{ vars.UNIFIED_CI_APP_ID }}"
+        installationId: "${{ vars.UNIFIED_CI_INSTALLATION_ID }}"
+        privateKey: ${{ secrets.UNIFIED_CI_PRIVATE_KEY }}
+
     - name: bump-build-number/checkout-repo
       uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       with:
@@ -29,7 +36,7 @@ jobs:
 
     - name: bump-build-number/bump-build-number
       env:
-        GH_TOKEN: "${{ github.token }}"
+        GH_TOKEN: "${{ steps.ghapp.outputs.token }}"
         DRY_RUN: no
       run: ./scripts/bump_build_number.sh
 ...
diff --git a/scripts/bump_build_number.sh b/scripts/bump_build_number.sh
@@ -55,9 +55,9 @@ if grep -qiE '^(no?|false)$' <<<$DRY_RUN; then
 Bump app build number to $BUILD_NUMBER
 
 #### Release Note
-```release-note
+\`\`\`release-note
 NONE
-```
+\`\`\`
 EOF
 else
   log "Running in DRY_RUN mode: skipping branch push and PR creation"