Skip to content

Commit 345012d

Browse files
jakebaileyjakebailey
authored
Switch from bot PAT to GitHub App token via Azure Key Vault (#63538)
1 parent 7539c04 commit 345012d

13 files changed

Lines changed: 1025 additions & 49 deletions

‎.github/workflows/accept-baselines-fix-lints.yaml‎

Lines changed: 29 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ on:
55

66
permissions:
77
contents: read
8+
id-token: write
89

910
# Ensure scripts are run with pipefail. See:
1011
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
@@ -15,11 +16,14 @@ defaults:
1516
jobs:
1617
build:
1718
runs-on: ubuntu-latest
19+
environment:
20+
name: azure
21+
deployment: false
1822

1923
steps:
2024
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2125
with:
22-
token: ${{ secrets.TS_BOT_GITHUB_TOKEN }}
26+
persist-credentials: false
2327
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
2428
with:
2529
node-version: 'lts/*'
@@ -37,4 +41,27 @@ jobs:
3741
git add ./tests/baselines/reference
3842
git diff --cached
3943
git commit -m "Update Baselines, Applied Lint Fixes, and/or Formatted"
40-
git push
44+
- uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
45+
with:
46+
client-id: ${{ vars.AZURE_CLIENT_ID }}
47+
tenant-id: ${{ vars.AZURE_TENANT_ID }}
48+
subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
49+
- name: Create GitHub App token
50+
id: app-token
51+
uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1
52+
with:
53+
client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }}
54+
key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }}
55+
owner: microsoft
56+
repositories: TypeScript
57+
permission-contents: write
58+
- name: Configure git for GitHub App token
59+
shell: bash
60+
env:
61+
GITHUB_APP_TOKEN: ${{ steps.app-token.outputs.token }}
62+
run: |
63+
set -euo pipefail
64+
basic_auth="$(node -e 'process.stdout.write(Buffer.from("x-access-token:" + process.env.GITHUB_APP_TOKEN).toString("base64"))')"
65+
echo "::add-mask::$basic_auth"
66+
git config --local http.https://github.com/.extraheader "AUTHORIZATION: basic ${basic_auth}"
67+
- run: git push

‎.github/workflows/close-issues.yml‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ on:
77

88
permissions:
99
contents: read
10+
id-token: write
1011

1112
# Ensure scripts are run with pipefail. See:
1213
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
@@ -17,15 +18,36 @@ defaults:
1718
jobs:
1819
close-issues:
1920
runs-on: ubuntu-latest
21+
environment:
22+
name: azure
23+
deployment: false
2024
if: github.repository == 'microsoft/TypeScript'
2125
permissions:
2226
contents: read # Apparently required to create issues
27+
id-token: write
2328
issues: write
2429

2530
steps:
31+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
32+
with:
33+
persist-credentials: false
34+
- uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
35+
with:
36+
client-id: ${{ vars.AZURE_CLIENT_ID }}
37+
tenant-id: ${{ vars.AZURE_TENANT_ID }}
38+
subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
39+
- name: Create GitHub App token
40+
id: app-token
41+
uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1
42+
with:
43+
client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }}
44+
key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }}
45+
owner: microsoft
46+
repositories: TypeScript
47+
permission-issues: write
2648
- name: Close issues
2749
env:
28-
GH_TOKEN: ${{ secrets.TS_BOT_GITHUB_TOKEN }}
50+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
2951
REPO: ${{ github.repository }}
3052
run: |
3153
DATE=$(date --date='2 days ago' --iso-8601)

‎.github/workflows/create-cherry-pick-pr.yml‎

Lines changed: 32 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ run-name: ${{ github.workflow }}${{ inputs.distinct_id && format(' (bot run {0})
3434

3535
permissions:
3636
contents: read
37+
id-token: write
3738

3839
# Ensure scripts are run with pipefail. See:
3940
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
@@ -44,15 +45,42 @@ defaults:
4445
jobs:
4546
open-pr:
4647
runs-on: ubuntu-latest
48+
environment:
49+
name: azure
50+
deployment: false
4751
if: github.repository == 'microsoft/TypeScript'
4852

4953
steps:
5054
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5155
with:
5256
filter: blob:none # https://github.blog/2020-12-21-get-up-to-speed-with-partial-clone-and-shallow-clone/
5357
fetch-depth: 0 # Default is 1; need to set to 0 to get the benefits of blob:none.
54-
token: ${{ secrets.TS_BOT_GITHUB_TOKEN }}
55-
58+
persist-credentials: false
59+
- uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
60+
with:
61+
client-id: ${{ vars.AZURE_CLIENT_ID }}
62+
tenant-id: ${{ vars.AZURE_TENANT_ID }}
63+
subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
64+
- name: Create GitHub App token
65+
id: app-token
66+
uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1
67+
with:
68+
client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }}
69+
key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }}
70+
owner: microsoft
71+
repositories: TypeScript
72+
permission-contents: write
73+
permission-issues: write
74+
permission-pull-requests: write
75+
- name: Configure git for GitHub App token
76+
shell: bash
77+
env:
78+
GITHUB_APP_TOKEN: ${{ steps.app-token.outputs.token }}
79+
run: |
80+
set -euo pipefail
81+
basic_auth="$(node -e 'process.stdout.write(Buffer.from("x-access-token:" + process.env.GITHUB_APP_TOKEN).toString("base64"))')"
82+
echo "::add-mask::$basic_auth"
83+
git config --local http.https://github.com/.extraheader "AUTHORIZATION: basic ${basic_auth}"
5684
- uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
5785
id: open-pr
5886
env:
@@ -64,7 +92,7 @@ jobs:
6492
STATUS_COMMENT: ${{ inputs.status_comment }}
6593
with:
6694
retries: 3
67-
github-token: ${{ secrets.TS_BOT_GITHUB_TOKEN }}
95+
github-token: ${{ steps.app-token.outputs.token }}
6896
result-encoding: string
6997
script: |
7098
const {
@@ -182,7 +210,7 @@ jobs:
182210
with:
183211
success_comment: ${{ steps.open-pr.outputs.result }}
184212
failure_comment: 'I was unable to cherry-pick this PR.'
185-
github_token: ${{ secrets.TS_BOT_GITHUB_TOKEN }}
213+
github_token: ${{ steps.app-token.outputs.token }}
186214
distinct_id: ${{ inputs.distinct_id }}
187215
source_issue: ${{ inputs.source_issue }}
188216
requesting_user: ${{ inputs.requesting_user }}

‎.github/workflows/lkg.yml‎

Lines changed: 29 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ on:
1010

1111
permissions:
1212
contents: read
13+
id-token: write
1314

1415
# Ensure scripts are run with pipefail. See:
1516
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
@@ -20,6 +21,9 @@ defaults:
2021
jobs:
2122
build:
2223
runs-on: ubuntu-latest
24+
environment:
25+
name: azure
26+
deployment: false
2327
steps:
2428
- env:
2529
BRANCH_NAME: ${{ inputs.branch_name }}
@@ -32,7 +36,7 @@ jobs:
3236
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3337
with:
3438
ref: ${{ inputs.branch_name }}
35-
token: ${{ secrets.TS_BOT_GITHUB_TOKEN }}
39+
persist-credentials: false
3640
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
3741
with:
3842
node-version: 'lts/*'
@@ -48,4 +52,27 @@ jobs:
4852
git config user.email "typescriptbot@microsoft.com"
4953
git config user.name "TypeScript Bot"
5054
git commit -m 'Update LKG'
51-
git push
55+
- uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
56+
with:
57+
client-id: ${{ vars.AZURE_CLIENT_ID }}
58+
tenant-id: ${{ vars.AZURE_TENANT_ID }}
59+
subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
60+
- name: Create GitHub App token
61+
id: app-token
62+
uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1
63+
with:
64+
client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }}
65+
key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }}
66+
owner: microsoft
67+
repositories: TypeScript
68+
permission-contents: write
69+
- name: Configure git for GitHub App token
70+
shell: bash
71+
env:
72+
GITHUB_APP_TOKEN: ${{ steps.app-token.outputs.token }}
73+
run: |
74+
set -euo pipefail
75+
basic_auth="$(node -e 'process.stdout.write(Buffer.from("x-access-token:" + process.env.GITHUB_APP_TOKEN).toString("base64"))')"
76+
echo "::add-mask::$basic_auth"
77+
git config --local http.https://github.com/.extraheader "AUTHORIZATION: basic ${basic_auth}"
78+
- run: git push

‎.github/workflows/new-release-branch.yaml‎

Lines changed: 32 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ run-name: ${{ github.workflow }}${{ inputs.distinct_id && format(' (bot run {0})
3838

3939
permissions:
4040
contents: read
41+
id-token: write
4142

4243
# Ensure scripts are run with pipefail. See:
4344
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
@@ -48,13 +49,16 @@ defaults:
4849
jobs:
4950
build:
5051
runs-on: ubuntu-latest
52+
environment:
53+
name: azure
54+
deployment: false
5155

5256
steps:
5357
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5458
with:
5559
filter: blob:none # https://github.blog/2020-12-21-get-up-to-speed-with-partial-clone-and-shallow-clone/
5660
fetch-depth: 0 # Default is 1; need to set to 0 to get the benefits of blob:none.
57-
token: ${{ secrets.TS_BOT_GITHUB_TOKEN }}
61+
persist-credentials: false
5862
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
5963
with:
6064
node-version: 'lts/*'
@@ -85,14 +89,39 @@ jobs:
8589
git config user.email "typescriptbot@microsoft.com"
8690
git config user.name "TypeScript Bot"
8791
git commit -m "Bump version to $PACKAGE_VERSION and LKG"
88-
git push --set-upstream origin "$BRANCH_NAME"
92+
- uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
93+
with:
94+
client-id: ${{ vars.AZURE_CLIENT_ID }}
95+
tenant-id: ${{ vars.AZURE_TENANT_ID }}
96+
subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
97+
- name: Create GitHub App token
98+
id: app-token
99+
uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1
100+
with:
101+
client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }}
102+
key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }}
103+
owner: microsoft
104+
repositories: TypeScript
105+
permission-contents: write
106+
- name: Configure git for GitHub App token
107+
shell: bash
108+
env:
109+
GITHUB_APP_TOKEN: ${{ steps.app-token.outputs.token }}
110+
run: |
111+
set -euo pipefail
112+
basic_auth="$(node -e 'process.stdout.write(Buffer.from("x-access-token:" + process.env.GITHUB_APP_TOKEN).toString("base64"))')"
113+
echo "::add-mask::$basic_auth"
114+
git config --local http.https://github.com/.extraheader "AUTHORIZATION: basic ${basic_auth}"
115+
- env:
116+
BRANCH_NAME: ${{ inputs.branch_name }}
117+
run: git push --set-upstream origin "$BRANCH_NAME"
89118

90119
- uses: microsoft/typescript-bot-test-triggerer/.github/actions/post-workflow-result@master
91120
if: ${{ !cancelled() && inputs.distinct_id }}
92121
with:
93122
success_comment: "I've created ${{ inputs.branch_name }} with version ${{ inputs.package_version }} for you."
94123
failure_comment: 'I was unable to create the new release branch.'
95-
github_token: ${{ secrets.TS_BOT_GITHUB_TOKEN }}
124+
github_token: ${{ steps.app-token.outputs.token }}
96125
distinct_id: ${{ inputs.distinct_id }}
97126
source_issue: ${{ inputs.source_issue }}
98127
requesting_user: ${{ inputs.requesting_user }}

‎.github/workflows/pr-modified-files.yml‎

Lines changed: 29 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ concurrency:
1717

1818
permissions:
1919
contents: read
20+
id-token: write
2021

2122
# Ensure scripts are run with pipefail. See:
2223
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
@@ -27,17 +28,37 @@ defaults:
2728
jobs:
2829
manage-prs:
2930
runs-on: ubuntu-latest
31+
environment:
32+
name: azure
33+
deployment: false
3034
if: github.repository == 'microsoft/TypeScript'
3135

32-
# No need to set explicit permissions; we are using typescript-bot's token, not github-actions' token.
36+
# No need to set explicit permissions; we are using the GitHub App token, not github-actions' token.
3337

3438
env:
35-
GH_TOKEN: ${{ secrets.TS_BOT_GITHUB_TOKEN }}
3639
PR_NUMBER: ${{ github.event.pull_request.number }}
3740
PR_AUTHOR: ${{ github.event.pull_request.user.login }}
3841
REPO: ${{ github.repository }}
3942

4043
steps:
44+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
45+
with:
46+
persist-credentials: false
47+
- uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
48+
with:
49+
client-id: ${{ vars.AZURE_CLIENT_ID }}
50+
tenant-id: ${{ vars.AZURE_TENANT_ID }}
51+
subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
52+
- name: Create GitHub App token
53+
id: app-token
54+
uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1
55+
with:
56+
client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }}
57+
key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }}
58+
owner: microsoft
59+
repositories: TypeScript
60+
permission-issues: write
61+
permission-pull-requests: write
4162
- name: Check if PR author is in pr_owners.txt
4263
id: pr_owner
4364
run: |
@@ -91,6 +112,8 @@ jobs:
91112
92113
- name: Generated DOM files
93114
if: steps.pr_owner.outputs.pr_owner == 'false'
115+
env:
116+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
94117
run: |
95118
if ./is_changed.sh "src/lib/dom.generated.d.ts" \
96119
"src/lib/dom.iterable.generated.d.ts" \
@@ -107,6 +130,8 @@ jobs:
107130
fi
108131
109132
- name: Check if PR modifies protocol.ts
133+
env:
134+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
110135
run: |
111136
if ./is_changed.sh "src/server/protocol.ts"; then
112137
MESSAGE="Thanks for the PR! It looks like you've changed the TSServer protocol in some way."
@@ -122,6 +147,8 @@ jobs:
122147
fi
123148
124149
- name: Check for breaking changes
150+
env:
151+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
125152
run: |
126153
if ./is_changed.sh "tests/baselines/reference/api/typescript.d.ts"; then
127154
MESSAGE="Looks like you're introducing a change to the public API surface area."

0 commit comments

Comments
 (0)