From 3c0a27710969bc32cfc53bdf3ceaf66c9c9b0c53 Mon Sep 17 00:00:00 2001 From: Javier Rodriguez Date: Tue, 11 Nov 2025 13:47:23 +0100 Subject: [PATCH 1/3] feat(gatherer): Use GitHub app instead of PAT for gatherer Signed-off-by: Javier Rodriguez --- .github/workflows/scm_configuration_check.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/scm_configuration_check.yaml b/.github/workflows/scm_configuration_check.yaml index e4bc94d11..580c26d97 100644 --- a/.github/workflows/scm_configuration_check.yaml +++ b/.github/workflows/scm_configuration_check.yaml @@ -29,6 +29,13 @@ jobs: run: | chainloop attestation init --workflow ${CHAINLOOP_WORKFLOW_NAME} --project ${CHAINLOOP_PROJECT_NAME} + - name: Generate a token + id: generate-token + uses: actions/create-github-app-token@v2 + with: + app-id: ${{ secrets.GATHERER_APP_ID }} + private-key: ${{ secrets.GATHERER_APP_PRIVATE_KEY }} + - name: Gather runner context data run: | chainloop gather-runner-context --runner-token ${{ secrets.PAT_ADMIN }} From fb9189cce690c453aa9d43f03a80434d6c607702 Mon Sep 17 00:00:00 2001 From: Javier Rodriguez Date: Tue, 11 Nov 2025 13:48:25 +0100 Subject: [PATCH 2/3] use generated token Signed-off-by: Javier Rodriguez --- .github/workflows/scm_configuration_check.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scm_configuration_check.yaml b/.github/workflows/scm_configuration_check.yaml index 580c26d97..d919149d8 100644 --- a/.github/workflows/scm_configuration_check.yaml +++ b/.github/workflows/scm_configuration_check.yaml @@ -38,7 +38,7 @@ jobs: - name: Gather runner context data run: | - chainloop gather-runner-context --runner-token ${{ secrets.PAT_ADMIN }} + chainloop gather-runner-context --runner-token ${{ steps.generate-token.outputs.token }} - name: Add runner context material to attestation run: | From ad6fed39ffa07a8a7039cf5ea300c0ef3be36c6e Mon Sep 17 00:00:00 2001 From: Javier Rodriguez Date: Tue, 11 Nov 2025 15:33:38 +0100 Subject: [PATCH 3/3] change secret for var Signed-off-by: Javier Rodriguez --- .github/workflows/scm_configuration_check.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scm_configuration_check.yaml b/.github/workflows/scm_configuration_check.yaml index d919149d8..a84f9869e 100644 --- a/.github/workflows/scm_configuration_check.yaml +++ b/.github/workflows/scm_configuration_check.yaml @@ -33,7 +33,7 @@ jobs: id: generate-token uses: actions/create-github-app-token@v2 with: - app-id: ${{ secrets.GATHERER_APP_ID }} + app-id: ${{ vars.CHAINLOOP_GATHERER_APP_ID }} private-key: ${{ secrets.GATHERER_APP_PRIVATE_KEY }} - name: Gather runner context data