Skip to content

ci: open the nightly and release PRs with a GitHub App token #112

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
botandbang merged 3 commits into from
Oct 23, 2026
Merged

ci: open the nightly and release PRs with a GitHub App token #112

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8a631f3
ci: pin actions, scope token permissions, and scan workflows
botandbang Oct 22, 2026
9923bcc
ci: open the nightly and release PRs with a GitHub App token
botandbang Oct 22, 2026
9e6ec7e
Merge remote-tracking branch 'origin/main' into bnb/ci-app-token
botandbang Oct 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 12 additions & 2 deletions .github/workflows/nightly-static-build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,8 +11,7 @@ jobs:
run-build:
runs-on: ubuntu-latest
permissions:
contents: write # push the `nightly` branch
pull-requests: write # open or update the data PR and assign it
contents: read # the app token below pushes and opens the PR
steps:
- name: Checkout the repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
Expand All @@ -34,9 +33,20 @@ jobs:
run: npm run build:support -w static
- name: Format Output
run: npm run lint:write -w static
# runs on a PR opened with GITHUB_TOKEN wait for someone to approve them;
# runs on an app token's PR start on their own
- name: Create a GitHub App token
id: app-token
uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
with:
client-id: ${{ vars.CI_APP_CLIENT_ID }}
private-key: ${{ secrets.CI_APP_PRIVATE_KEY }}
permission-contents: write # push the `nightly` branch
permission-pull-requests: write # open or update the data PR and assign it
- name: Create or Update Pull Request
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
with:
token: ${{ steps.app-token.outputs.token }}
title: 'feat: update data'
body: 'Updates the static data based on a nightly (or manual) run of the build step in GitHub Actions. Unless the data is invalid, this should be good to go.'
branch: 'nightly'
Expand Down
15 changes: 11 additions & 4 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,13 +18,20 @@ jobs:
pr:
if: github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
runs-on: ubuntu-latest
permissions:
contents: write # push the `release/vX.Y.Z` branch and delete superseded ones
pull-requests: write # create a release PR, update its body, close superseded PRs
permissions: {} # uppt/pr does everything with the app token below
steps:
# runs on a PR opened with GITHUB_TOKEN wait for someone to approve them;
# runs on an app token's PR start on their own
- id: app-token
uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
with:
client-id: ${{ vars.CI_APP_CLIENT_ID }}
private-key: ${{ secrets.CI_APP_PRIVATE_KEY }}
permission-contents: write # push the `release/vX.Y.Z` branch and delete superseded ones
permission-pull-requests: write # create a release PR, update its body, close superseded PRs
- uses: danielroe/uppt/pr@7bcfb5397c37202ef882363f755423130419d28a # v0.5.5
with:
token: ${{ secrets.GITHUB_TOKEN }}
token: ${{ steps.app-token.outputs.token }}
packages: |
aliases
core
Expand Down
Loading