From 45fcabef8c4f404ec91aaf7f1361ae7ee3dd69d0 Mon Sep 17 00:00:00 2001 From: Alex van Andel Date: Tue, 16 Dec 2025 14:12:56 +0000 Subject: [PATCH] chore: replace GH_ACCESS_TOKEN with GitHub App token (#25518) * chore: replace GH_ACCESS_TOKEN with GitHub App token Replace personal access token (GH_ACCESS_TOKEN) with GitHub App token generation using actions/create-github-app-token@v1 for improved security. Updated workflows: - draft-release.yml - post-release.yml - cleanup.yml - cleanup-report.yml - publish-report.yml - i18n.yml Benefits: - Short-lived tokens (1 hour) vs long-lived PATs - Fine-grained, scoped permissions - Not tied to individual user accounts - Better audit trail Required setup: - Create a GitHub App with contents:write permission - Install the app on calcom/cal.com and calcom/test-results-2 - Add RELEASE_APP_ID and RELEASE_APP_PRIVATE_KEY secrets Co-Authored-By: alex@cal.com * chore: rename secrets to CI_CAL_APP_ID and CI_CAL_APP_PRIVATE_KEY Co-Authored-By: alex@cal.com * chore: use reusable workflow from calcom-ci-secrets for token generation This isolates the GitHub App private key in a separate repository, ensuring that compromised actions in cal.com can only access short-lived tokens, not the key itself. Co-Authored-By: alex@cal.com * chore: use explicit secret passing instead of secrets: inherit Only pass the two required secrets (CI_CAL_APP_ID, CI_CAL_APP_PRIVATE_KEY) to the reusable workflow instead of inheriting all secrets. Co-Authored-By: alex@cal.com * chore: remove secrets block - using environment secrets from calcom-ci-secrets Secrets are now loaded from the ci-github-app environment in calcom-ci-secrets, so cal.com workflows no longer need to pass them. Co-Authored-By: alex@cal.com * chore: revert to explicit secret passing Environment secrets in cross-repo reusable workflows don't work as expected. Secrets must be passed explicitly from the caller repository. Co-Authored-By: alex@cal.com * chore: generate GitHub App token directly in workflows Remove dependency on calcom-ci-secrets reusable workflow. Token generation is now inline using actions/create-github-app-token pinned to SHA 7e473efe3cb98aa54f8d4bac15400b15fad77d94 (v2.2.0). Co-Authored-By: alex@cal.com --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com> --- .github/workflows/cleanup-report.yml | 10 +++++++++- .github/workflows/cleanup.yml | 12 ++++++++++-- .github/workflows/draft-release.yml | 11 +++++++++-- .github/workflows/i18n.yml | 10 +++++++++- .github/workflows/post-release.yml | 13 ++++++++++++- .github/workflows/publish-report.yml | 10 +++++++++- 6 files changed, 58 insertions(+), 8 deletions(-) diff --git a/.github/workflows/cleanup-report.yml b/.github/workflows/cleanup-report.yml index 50f0716ee0..e4012ca2ea 100644 --- a/.github/workflows/cleanup-report.yml +++ b/.github/workflows/cleanup-report.yml @@ -11,12 +11,20 @@ jobs: cleanup-report: runs-on: ubuntu-latest steps: + - name: Generate GitHub App token + id: generate-token + uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 + with: + app-id: ${{ secrets.CI_CAL_APP_ID }} + private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }} + repositories: 'test-results-2' + - name: Checkout GitHub Pages Branch uses: actions/checkout@v4 with: repository: calcom/test-results-2 ref: gh-pages - token: ${{ secrets.GH_ACCESS_TOKEN }} + token: ${{ steps.generate-token.outputs.token }} - name: Set Git User run: | diff --git a/.github/workflows/cleanup.yml b/.github/workflows/cleanup.yml index 501c88c769..6e7fd6140e 100644 --- a/.github/workflows/cleanup.yml +++ b/.github/workflows/cleanup.yml @@ -22,12 +22,20 @@ jobs: # Contains all reports for deleted branch BRANCH_REPORTS_DIR: reports/${{ github.event.ref }} steps: + - name: Generate GitHub App token + id: generate-token + uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 + with: + app-id: ${{ secrets.CI_CAL_APP_ID }} + private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }} + repositories: 'test-results-2' + - name: Checkout GitHub Pages Branch - uses: actions/checkout@v2 + uses: actions/checkout@v4 with: repository: calcom/test-results-2 ref: gh-pages - token: ${{ secrets.GH_ACCESS_TOKEN }} + token: ${{ steps.generate-token.outputs.token }} - name: Set Git User # see: https://github.com/actions/checkout/issues/13#issuecomment-724415212 run: | diff --git a/.github/workflows/draft-release.yml b/.github/workflows/draft-release.yml index 40ab791c4e..d56a64542a 100644 --- a/.github/workflows/draft-release.yml +++ b/.github/workflows/draft-release.yml @@ -17,13 +17,20 @@ jobs: runs-on: ubuntu-latest steps: - + - name: Generate GitHub App token + id: generate-token + uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 + with: + app-id: ${{ secrets.CI_CAL_APP_ID }} + private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }} + repositories: 'cal.com' + - name: Checkout code uses: actions/checkout@v4 with: fetch-depth: 0 ref: 'main' - token: ${{ secrets.GH_ACCESS_TOKEN }} + token: ${{ steps.generate-token.outputs.token }} - name: Configure git run: | diff --git a/.github/workflows/i18n.yml b/.github/workflows/i18n.yml index b3b0d99c13..b3118bc5b2 100644 --- a/.github/workflows/i18n.yml +++ b/.github/workflows/i18n.yml @@ -16,6 +16,14 @@ jobs: contents: write pull-requests: write steps: + - name: Generate GitHub App token + id: generate-token + uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 + with: + app-id: ${{ secrets.CI_CAL_APP_ID }} + private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }} + repositories: 'cal.com' + - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: @@ -23,7 +31,7 @@ jobs: cache: 'npm' - uses: lingodotdev/lingo.dev@main env: - GH_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }} + GH_TOKEN: ${{ steps.generate-token.outputs.token }} with: api-key: ${{ secrets.CI_LINGO_DOT_DEV_API_KEY }} pull-request: true diff --git a/.github/workflows/post-release.yml b/.github/workflows/post-release.yml index 252df829c3..ddcef9f5ce 100644 --- a/.github/workflows/post-release.yml +++ b/.github/workflows/post-release.yml @@ -6,16 +6,27 @@ on: tags: - "*" +permissions: + contents: write + jobs: release: runs-on: ubuntu-latest steps: + - name: Generate GitHub App token + id: generate-token + uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 + with: + app-id: ${{ secrets.CI_CAL_APP_ID }} + private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }} + repositories: 'cal.com' + - name: Checkout code uses: actions/checkout@v4 with: fetch-depth: 0 ref: 'main' - token: ${{ secrets.GH_ACCESS_TOKEN }} + token: ${{ steps.generate-token.outputs.token }} - name: Configure git run: | diff --git a/.github/workflows/publish-report.yml b/.github/workflows/publish-report.yml index decfc26cf9..f3af9ee335 100644 --- a/.github/workflows/publish-report.yml +++ b/.github/workflows/publish-report.yml @@ -13,12 +13,20 @@ jobs: HTML_REPORT_URL_PATH: reports/${{ github.head_ref }}/${{ github.run_id }}/${{ github.run_attempt }} BRANCH_REPORTS_DIR: reports/${{ github.head_ref }} steps: + - name: Generate GitHub App token + id: generate-token + uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 + with: + app-id: ${{ secrets.CI_CAL_APP_ID }} + private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }} + repositories: 'test-results-2' + - name: Checkout GitHub Pages Branch uses: actions/checkout@v4 with: repository: calcom/test-results-2 ref: gh-pages - token: ${{ secrets.GH_ACCESS_TOKEN }} + token: ${{ steps.generate-token.outputs.token }} - name: Set Git User # see: https://github.com/actions/checkout/issues/13#issuecomment-724415212 run: |