diff --git a/.github/workflows/build-test-release.yaml b/.github/workflows/build-test-release.yaml index 61404e99..561fefc8 100644 --- a/.github/workflows/build-test-release.yaml +++ b/.github/workflows/build-test-release.yaml @@ -41,6 +41,12 @@ jobs: - pre-commit runs-on: ubuntu-latest steps: + - uses: actions/create-github-app-token@v3 + id: app-token + with: + client-id: ${{ secrets.GH_APP_CLIENT_ID }} + private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} + owner: ${{ github.repository_owner }} - uses: actions/checkout@v4 with: submodules: false @@ -48,7 +54,7 @@ jobs: - name: Semantic Release uses: splunk/semantic-release-action@v1.3 env: - GITHUB_TOKEN: ${{ secrets.GH_TOKEN_ADMIN }} + GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} with: git_committer_name: ${{ secrets.SA_GH_USER_NAME }} git_committer_email: ${{ secrets.SA_GH_USER_EMAIL }} @@ -60,10 +66,16 @@ jobs: needs: publish runs-on: ubuntu-latest steps: + - uses: actions/create-github-app-token@v3 + id: app-token + with: + client-id: ${{ secrets.GH_APP_CLIENT_ID }} + private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} + owner: ${{ github.repository_owner }} - uses: actions/checkout@v4 - uses: splunk/addonfactory-update-semver@v1 env: - GITHUB_TOKEN: ${{ secrets.GH_TOKEN_ADMIN }} + GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} with: git_committer_name: ${{ secrets.SA_GH_USER_NAME }} git_committer_email: ${{ secrets.SA_GH_USER_EMAIL }} diff --git a/.github/workflows/reusable-build-test-release.yml b/.github/workflows/reusable-build-test-release.yml index e1a445f0..919005a1 100644 --- a/.github/workflows/reusable-build-test-release.yml +++ b/.github/workflows/reusable-build-test-release.yml @@ -73,8 +73,11 @@ on: type: string default: "0.3" secrets: - GH_TOKEN_ADMIN: - description: Github admin token + GH_APP_CLIENT_ID: + description: GitHub App Client ID for authentication + required: true + GH_APP_PRIVATE_KEY: + description: GitHub App private key for authentication required: true SEMGREP_PUBLISH_TOKEN: description: Semgrep token @@ -518,6 +521,12 @@ jobs: statuses: read checks: write steps: + - uses: actions/create-github-app-token@v3 + id: app-token + with: + client-id: ${{ secrets.GH_APP_CLIENT_ID }} + private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} + owner: ${{ github.repository_owner }} - uses: actions/checkout@v4 - uses: actions/setup-python@v5 with: @@ -534,8 +543,8 @@ jobs: echo "No poetry.lock found, make sure your dependencies are managed through poetry, exiting" exit 1 fi - git config --global --add url."https://${{ secrets.GH_TOKEN_ADMIN }}@github.com".insteadOf https://github.com - git config --global --add url."https://${{ secrets.GH_TOKEN_ADMIN }}@github.com".insteadOf ssh://git@github.com + git config --global --add url."https://${{ steps.app-token.outputs.token }}@github.com".insteadOf https://github.com + git config --global --add url."https://${{ steps.app-token.outputs.token }}@github.com".insteadOf ssh://git@github.com python${{ env.PYTHON_VERSION }} -m venv ~/.dev_venv ~/.dev_venv/bin/python${{ env.PYTHON_VERSION }} -m pip install -r package/lib/requirements.txt - name: Create directories @@ -590,6 +599,12 @@ jobs: contents: write packages: read steps: + - uses: actions/create-github-app-token@v3 + id: app-token + with: + client-id: ${{ secrets.GH_APP_CLIENT_ID }} + private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} + owner: ${{ github.repository_owner }} - uses: actions/checkout@v4 with: # Very Important semantic-release won't trigger a tagged @@ -601,8 +616,8 @@ jobs: python-version: ${{ env.PYTHON_VERSION }} - name: create requirements file for pip run: | - git config --global --add url."https://${{ secrets.GH_TOKEN_ADMIN }}@github.com".insteadOf https://github.com - git config --global --add url."https://${{ secrets.GH_TOKEN_ADMIN }}@github.com".insteadOf ssh://git@github.com + git config --global --add url."https://${{ steps.app-token.outputs.token }}@github.com".insteadOf https://github.com + git config --global --add url."https://${{ steps.app-token.outputs.token }}@github.com".insteadOf ssh://git@github.com if [ -f "poetry.lock" ] then echo " poetry.lock found " @@ -862,6 +877,12 @@ jobs: if: ${{ !cancelled() && needs.build.result == 'success' && needs.setup-workflow.outputs.execute-gs-scorecard == 'true' }} runs-on: ubuntu-latest steps: + - uses: actions/create-github-app-token@v3 + id: app-token + with: + client-id: ${{ secrets.GH_APP_CLIENT_ID }} + private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} + owner: ${{ github.repository_owner }} - uses: actions/checkout@v4 - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@v4 @@ -876,7 +897,7 @@ jobs: docker pull 956110764581.dkr.ecr.us-west-2.amazonaws.com/ta-automation/gs-scorecard:${{ env.GS_IMAGE_VERSION }} - name: Run GS Scorecard env: - GITHUB_TOKEN: ${{ secrets.GH_TOKEN_ADMIN }} + GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} GITHUB_USERNAME: ${{ secrets.SA_GH_USER_NAME }} APPINSPECT_USER: ${{ secrets.SPL_COM_USER }} APPINSPECT_PASS: ${{ secrets.SPL_COM_PASSWORD }} @@ -938,10 +959,16 @@ jobs: env: BUILD_NAME: ${{ needs.build.outputs.buildname }} steps: + - uses: actions/create-github-app-token@v3 + id: app-token + with: + client-id: ${{ secrets.GH_APP_CLIENT_ID }} + private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} + owner: ${{ github.repository_owner }} - uses: actions/checkout@v4 with: submodules: recursive - token: ${{ secrets.GH_TOKEN_ADMIN }} + token: ${{ steps.app-token.outputs.token }} - name: setup for test id: test-setup shell: bash @@ -993,9 +1020,9 @@ jobs: python${{ env.PYTHON_VERSION }} -m pip install poetry==${{ env.POETRY_VERSION }} export POETRY_REPOSITORIES_SPLUNK_ADD_ON_UCC_MODINPUT_TEST_URL=https://github.com/splunk/addonfactory-ucc-test.git export POETRY_HTTP_BASIC_SPLUNK_ADD_ON_UCC_MODINPUT_TEST_USERNAME=${{ secrets.SA_GH_USER_NAME }} - export POETRY_HTTP_BASIC_SPLUNK_ADD_ON_UCC_MODINPUT_TEST_PASSWORD=${{ secrets.GH_TOKEN_ADMIN }} - git config --global --add url."https://${{ secrets.GH_TOKEN_ADMIN }}@github.com".insteadOf https://github.com - git config --global --add url."https://${{ secrets.GH_TOKEN_ADMIN }}@github.com".insteadOf ssh://git@github.com + export POETRY_HTTP_BASIC_SPLUNK_ADD_ON_UCC_MODINPUT_TEST_PASSWORD=${{ steps.app-token.outputs.token }} + git config --global --add url."https://${{ steps.app-token.outputs.token }}@github.com".insteadOf https://github.com + git config --global --add url."https://${{ steps.app-token.outputs.token }}@github.com".insteadOf ssh://git@github.com - name: modinput-test-prerequisites if: steps.download-openapi.conclusion != 'skipped' shell: bash @@ -2969,6 +2996,12 @@ jobs: pull-requests: read statuses: write steps: + - uses: actions/create-github-app-token@v3 + id: app-token + with: + client-id: ${{ secrets.GH_APP_CLIENT_ID }} + private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} + owner: ${{ github.repository_owner }} - name: Checkout uses: actions/checkout@v4 with: @@ -2979,7 +3012,7 @@ jobs: id: semantic uses: splunk/semantic-release-action@v1.3 env: - GITHUB_TOKEN: ${{ secrets.GH_TOKEN_ADMIN }} + GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} with: git_committer_name: ${{ secrets.SA_GH_USER_NAME }} git_committer_email: ${{ secrets.SA_GH_USER_EMAIL }} @@ -2990,7 +3023,7 @@ jobs: id: custom uses: "softprops/action-gh-release@v2" with: - token: "${{ secrets.GH_TOKEN_ADMIN }}" + token: "${{ steps.app-token.outputs.token }}" tag_name: v${{ github.event.inputs.custom-version }} target_commitish: "${{github.ref_name}}" make_latest: false diff --git a/README.md b/README.md index 35d4bb40..d5354818 100644 --- a/README.md +++ b/README.md @@ -625,7 +625,7 @@ appinspect-api-html-report-self-service - Verify that the required secrets are properly configured in GitHub Actions: - `GSSA_AWS_ACCESS_KEY_ID` and `GSSA_AWS_SECRET_ACCESS_KEY` for AWS ECR access - - `GH_TOKEN_ADMIN` and `SA_GH_USER_NAME` for GitHub access + - `GH_APP_PRIVATE_KEY` (secret) and `GH_APP_CLIENT_ID` (variable) for GitHub App authentication, and `SA_GH_USER_NAME` for GitHub access - `SPL_COM_USER` and `SPL_COM_PASSWORD` for AppInspect integration - Check that the Docker image version specified via the `gs-image-version` workflow input (`GS_IMAGE_VERSION` env var, default `1.1`) exists in the ECR registry. The GS Scorecard tool version is controlled separately via `gs-version` input (`GS_VERSION` env var, default `0.3`).