mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 20:00:08 +00:00
Anso
af4b17cc37
Replace the long-lived DOCS_REPO_TOKEN personal access token with short-lived installation tokens minted per-job from the sencho-token-app GitHub App (owned by the AnsoCode org, installed on both Sencho and sencho-docs). Why this is better than the PAT: - Scoped per-job to only the repo the job actually touches, not one token that works everywhere. update-screenshots and release-please mint against Sencho; sync-docs mints against sencho-docs. - Scoped per-job to only the permission scopes the job actually needs (contents:write and sometimes pull-requests:write), not the broader scope a PAT carries. - Auto-revoked at job end by the action's post-run step, so a leaked log line or artifact is useful for at most the remainder of that job. - Not tied to any individual user account: no more risk of the token silently dying when the human who minted it leaves or rotates keys. - Like a PAT but unlike GITHUB_TOKEN, installation tokens DO trigger downstream workflow runs, so the release-please tag push still cascades into docker-publish.yml exactly as before. Jobs migrated: - release-please.yml: single mint, passed to release-please-action. - ci.yml update-screenshots: one mint reused by checkout, peter-evans create-pull-request, and the gh pr merge step. - ci.yml sync-docs: one mint targeting sencho-docs, fed to the git clone URL as x-access-token. DOCS_REPO_TOKEN can be deleted from repo secrets after the first full release cycle under this migration validates release-please, update-screenshots, and sync-docs all succeed end-to-end. actions/create-github-app-token pinned to v3.0.0 at SHA f8d387b68d61c58ab83c6c016672934102569859, consistent with the SHA-pinning convention established in the supply-chain hardening PR.