From af4b17cc372572ef5d42c3e9753cb749c451e30b Mon Sep 17 00:00:00 2001 From: Anso Date: Fri, 10 Apr 2026 15:48:33 -0400 Subject: [PATCH] ci: migrate DOCS_REPO_TOKEN to sencho-token-app installation token (#490) Replace the long-lived DOCS_REPO_TOKEN personal access token with short-lived installation tokens minted per-job from the sencho-token-app GitHub App (owned by the AnsoCode org, installed on both Sencho and sencho-docs). Why this is better than the PAT: - Scoped per-job to only the repo the job actually touches, not one token that works everywhere. update-screenshots and release-please mint against Sencho; sync-docs mints against sencho-docs. - Scoped per-job to only the permission scopes the job actually needs (contents:write and sometimes pull-requests:write), not the broader scope a PAT carries. - Auto-revoked at job end by the action's post-run step, so a leaked log line or artifact is useful for at most the remainder of that job. - Not tied to any individual user account: no more risk of the token silently dying when the human who minted it leaves or rotates keys. - Like a PAT but unlike GITHUB_TOKEN, installation tokens DO trigger downstream workflow runs, so the release-please tag push still cascades into docker-publish.yml exactly as before. Jobs migrated: - release-please.yml: single mint, passed to release-please-action. - ci.yml update-screenshots: one mint reused by checkout, peter-evans create-pull-request, and the gh pr merge step. - ci.yml sync-docs: one mint targeting sencho-docs, fed to the git clone URL as x-access-token. DOCS_REPO_TOKEN can be deleted from repo secrets after the first full release cycle under this migration validates release-please, update-screenshots, and sync-docs all succeed end-to-end. actions/create-github-app-token pinned to v3.0.0 at SHA f8d387b68d61c58ab83c6c016672934102569859, consistent with the SHA-pinning convention established in the supply-chain hardening PR. --- .github/workflows/ci.yml | 37 +++++++++++++++++++++++++--- .github/workflows/release-please.yml | 23 ++++++++++++++--- 2 files changed, 52 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 247917ee..66e66be6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -225,10 +225,24 @@ jobs: contents: write pull-requests: write steps: + # Mint a short-lived installation token for the `sencho-token-app` + # GitHub App. Reused by the checkout, PR creation, and auto-merge + # steps below so we make exactly one /app/installations token call. + - name: Generate GitHub App installation token + id: app-token + uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0 + with: + app-id: ${{ secrets.APP_ID }} + private-key: ${{ secrets.APP_PRIVATE_KEY }} + owner: ${{ github.repository_owner }} + repositories: Sencho + permission-contents: write + permission-pull-requests: write + - name: Checkout Code uses: actions/checkout@v6 with: - token: ${{ secrets.DOCS_REPO_TOKEN }} + token: ${{ steps.app-token.outputs.token }} - name: Start app & install Playwright uses: ./.github/actions/start-app @@ -240,7 +254,7 @@ jobs: id: create-pr uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: - token: ${{ secrets.DOCS_REPO_TOKEN }} + token: ${{ steps.app-token.outputs.token }} branch: chore/refresh-screenshots commit-message: "docs: refresh screenshots" title: "docs: refresh screenshots" @@ -251,7 +265,7 @@ jobs: - name: Auto-merge screenshots PR if: steps.create-pr.outputs.pull-request-number != '' env: - GH_TOKEN: ${{ secrets.DOCS_REPO_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} run: | gh pr merge ${{ steps.create-pr.outputs.pull-request-number }} \ --squash \ @@ -263,6 +277,21 @@ jobs: timeout-minutes: 5 if: github.event_name == 'push' && github.ref == 'refs/heads/main' steps: + # This job mirrors docs/ into the sibling sencho-docs repo. The token + # must therefore be scoped to `sencho-docs`, not the current repo, so + # we mint an installation token explicitly targeting that repo. + # Minted unconditionally so the step graph stays simple; the token + # auto-revokes on post-step even when the gate below is false. + - name: Generate GitHub App installation token + id: app-token + uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0 + with: + app-id: ${{ secrets.APP_ID }} + private-key: ${{ secrets.APP_PRIVATE_KEY }} + owner: ${{ github.repository_owner }} + repositories: sencho-docs + permission-contents: write + - name: Checkout Sencho repo uses: actions/checkout@v6 with: @@ -289,7 +318,7 @@ jobs: - name: Clone or init sencho-docs if: steps.detect.outputs.changed == 'true' env: - DOCS_TOKEN: ${{ secrets.DOCS_REPO_TOKEN }} + DOCS_TOKEN: ${{ steps.app-token.outputs.token }} run: | rm -rf sencho-docs diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 7fb4f30f..ba412b36 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -13,11 +13,26 @@ jobs: release-please: runs-on: ubuntu-latest steps: + # Mint a short-lived installation token for the `sencho-token-app` + # GitHub App instead of using a long-lived user PAT. The token: + # - is scoped to this one repository (least privilege) + # - requests only the permissions release-please actually needs + # - is auto-revoked by the action's post step at job end + # - unlike GITHUB_TOKEN, CAN trigger downstream workflow runs, so the + # tag push from release-please still cascades to docker-publish.yml + - name: Generate GitHub App installation token + id: app-token + uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0 + with: + app-id: ${{ secrets.APP_ID }} + private-key: ${{ secrets.APP_PRIVATE_KEY }} + owner: ${{ github.repository_owner }} + repositories: Sencho + permission-contents: write + permission-pull-requests: write + - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0 with: - # GITHUB_TOKEN cannot trigger other workflows (GitHub security restriction). - # Using DOCS_REPO_TOKEN (PAT) ensures the tag push from release-please - # cascades to docker-publish.yml and publishes to Docker Hub. - token: ${{ secrets.DOCS_REPO_TOKEN }} + token: ${{ steps.app-token.outputs.token }} config-file: release-please-config.json manifest-file: .release-please-manifest.json