build: extract token setup from bootstrap composite action

seandstewart · Sep 5, 2024 · 58fda98 · 58fda98
1 parent 1f10063
commit 58fda98
Show file tree

Hide file tree

Showing 4 changed files with 21 additions and 13 deletions.
diff --git a/.github/actions/bootstrap-environ/action.yml b/.github/actions/bootstrap-environ/action.yml
@@ -6,20 +6,10 @@ inputs:
     description: The Python version to build your environment with.
   runner:
     description: The Runner to build your environment on.
-  release-private-key:
-    description: The private key used to authenticate the release bot app.
 
 runs:
   using: composite
   steps:
-  - uses: actions/create-github-app-token@v1
-    id: app-token
-    with:
-      app-id: 988070
-      private-key: ${{ inputs.release-app-private-key }}
-  - uses: actions/checkout@v4
-    with:
-      token: ${{ steps.app-token.outputs.token }}
   - uses: actions/setup-python@v5
     with:
       python-version: ${{ inputs.python-version }}

diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
@@ -21,13 +21,19 @@ jobs:
         os: [ ubuntu-latest ]
         python-version: [ "3.x" ]
     steps:
+    - uses: actions/create-github-app-token@v1
+      id: app-token
+      with:
+        app-id: ${{ vars.RELEASE_BOT_APP_ID }}
+        private-key: ${{ secrets.RELEASE_BOT_APP_PKEY }}
     - uses: actions/checkout@v4
+      with:
+        token: ${{ steps.app-token.outputs.token }}
     - uses: ./.github/actions/bootstrap-environ
       id: bootstrap-environ
       with:
         python-version: ${{ matrix.python-version }}
         runner: ${{ matrix.os }}
-        release-private-key: ${{ secrets.RELEASE_BOT_APP_PKEY }}
     - name: Update the Changelog
       run: |
         make changelog

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -79,12 +79,18 @@ jobs:
       id-token: write  # IMPORTANT: mandatory for sigstore
 
     steps:
+    - uses: actions/create-github-app-token@v1
+      id: app-token
+      with:
+        app-id: ${{ vars.RELEASE_BOT_APP_ID }}
+        private-key: ${{ secrets.RELEASE_BOT_APP_PKEY }}
     - uses: actions/checkout@v4
+      with:
+        token: ${{ steps.app-token.outputs.token }}
     - uses: ./.github/actions/bootstrap-environ
       with:
         python-version: 3.x
         runner: ubuntu-latest
-        release-private-key: ${{ secrets.RELEASE_BOT_APP_PKEY }}
     - name: Download all the dists
       uses: actions/download-artifact@v4
       with:

diff --git a/.github/workflows/tag.yml b/.github/workflows/tag.yml
@@ -28,13 +28,19 @@ jobs:
         os: [ ubuntu-latest ]
         python-version: [ "3.9" ]
     steps:
+    - uses: actions/create-github-app-token@v1
+      id: app-token
+      with:
+        app-id: ${{ vars.RELEASE_BOT_APP_ID }}
+        private-key: ${{ secrets.RELEASE_BOT_APP_PKEY }}
     - uses: actions/checkout@v4
+      with:
+        token: ${{ steps.app-token.outputs.token }}
     - uses: ./.github/actions/bootstrap-environ
       id: bootstrap-environ
       with:
         python-version: ${{ matrix.python-version }}
         runner: ${{ matrix.os }}
-        release-private-key: ${{ secrets.RELEASE_BOT_APP_PKEY }}
     - name: Tag New Version
       run: make release-version rule=${{ inputs.level }}
     - name: Push New Version