chore: replace GH_ACCESS_TOKEN with GitHub App token (#25518)
* chore: replace GH_ACCESS_TOKEN with GitHub App token Replace personal access token (GH_ACCESS_TOKEN) with GitHub App token generation using actions/create-github-app-token@v1 for improved security. Updated workflows: - draft-release.yml - post-release.yml - cleanup.yml - cleanup-report.yml - publish-report.yml - i18n.yml Benefits: - Short-lived tokens (1 hour) vs long-lived PATs - Fine-grained, scoped permissions - Not tied to individual user accounts - Better audit trail Required setup: - Create a GitHub App with contents:write permission - Install the app on calcom/cal.com and calcom/test-results-2 - Add RELEASE_APP_ID and RELEASE_APP_PRIVATE_KEY secrets Co-Authored-By: alex@cal.com <me@alexvanandel.com> * chore: rename secrets to CI_CAL_APP_ID and CI_CAL_APP_PRIVATE_KEY Co-Authored-By: alex@cal.com <me@alexvanandel.com> * chore: use reusable workflow from calcom-ci-secrets for token generation This isolates the GitHub App private key in a separate repository, ensuring that compromised actions in cal.com can only access short-lived tokens, not the key itself. Co-Authored-By: alex@cal.com <me@alexvanandel.com> * chore: use explicit secret passing instead of secrets: inherit Only pass the two required secrets (CI_CAL_APP_ID, CI_CAL_APP_PRIVATE_KEY) to the reusable workflow instead of inheriting all secrets. Co-Authored-By: alex@cal.com <me@alexvanandel.com> * chore: remove secrets block - using environment secrets from calcom-ci-secrets Secrets are now loaded from the ci-github-app environment in calcom-ci-secrets, so cal.com workflows no longer need to pass them. Co-Authored-By: alex@cal.com <me@alexvanandel.com> * chore: revert to explicit secret passing Environment secrets in cross-repo reusable workflows don't work as expected. Secrets must be passed explicitly from the caller repository. Co-Authored-By: alex@cal.com <me@alexvanandel.com> * chore: generate GitHub App token directly in workflows Remove dependency on calcom-ci-secrets reusable workflow. Token generation is now inline using actions/create-github-app-token pinned to SHA 7e473efe3cb98aa54f8d4bac15400b15fad77d94 (v2.2.0). Co-Authored-By: alex@cal.com <me@alexvanandel.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com>
This commit is contained in:
Alex van Andel
co-authored by
Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Anik Dhabal Babu
Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Anik Dhabal Babu
parent
593ed461c8
commit
45fcabef8c
@@ -11,12 +11,20 @@ jobs:
|
||||
cleanup-report:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Generate GitHub App token
|
||||
id: generate-token
|
||||
uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
|
||||
with:
|
||||
app-id: ${{ secrets.CI_CAL_APP_ID }}
|
||||
private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
|
||||
repositories: 'test-results-2'
|
||||
|
||||
- name: Checkout GitHub Pages Branch
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: calcom/test-results-2
|
||||
ref: gh-pages
|
||||
token: ${{ secrets.GH_ACCESS_TOKEN }}
|
||||
token: ${{ steps.generate-token.outputs.token }}
|
||||
|
||||
- name: Set Git User
|
||||
run: |
|
||||
|
||||
@@ -22,12 +22,20 @@ jobs:
|
||||
# Contains all reports for deleted branch
|
||||
BRANCH_REPORTS_DIR: reports/${{ github.event.ref }}
|
||||
steps:
|
||||
- name: Generate GitHub App token
|
||||
id: generate-token
|
||||
uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
|
||||
with:
|
||||
app-id: ${{ secrets.CI_CAL_APP_ID }}
|
||||
private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
|
||||
repositories: 'test-results-2'
|
||||
|
||||
- name: Checkout GitHub Pages Branch
|
||||
uses: actions/checkout@v2
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: calcom/test-results-2
|
||||
ref: gh-pages
|
||||
token: ${{ secrets.GH_ACCESS_TOKEN }}
|
||||
token: ${{ steps.generate-token.outputs.token }}
|
||||
- name: Set Git User
|
||||
# see: https://github.com/actions/checkout/issues/13#issuecomment-724415212
|
||||
run: |
|
||||
|
||||
@@ -17,13 +17,20 @@ jobs:
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
|
||||
- name: Generate GitHub App token
|
||||
id: generate-token
|
||||
uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
|
||||
with:
|
||||
app-id: ${{ secrets.CI_CAL_APP_ID }}
|
||||
private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
|
||||
repositories: 'cal.com'
|
||||
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
ref: 'main'
|
||||
token: ${{ secrets.GH_ACCESS_TOKEN }}
|
||||
token: ${{ steps.generate-token.outputs.token }}
|
||||
|
||||
- name: Configure git
|
||||
run: |
|
||||
|
||||
@@ -16,6 +16,14 @@ jobs:
|
||||
contents: write
|
||||
pull-requests: write
|
||||
steps:
|
||||
- name: Generate GitHub App token
|
||||
id: generate-token
|
||||
uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
|
||||
with:
|
||||
app-id: ${{ secrets.CI_CAL_APP_ID }}
|
||||
private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
|
||||
repositories: 'cal.com'
|
||||
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
@@ -23,7 +31,7 @@ jobs:
|
||||
cache: 'npm'
|
||||
- uses: lingodotdev/lingo.dev@main
|
||||
env:
|
||||
GH_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}
|
||||
GH_TOKEN: ${{ steps.generate-token.outputs.token }}
|
||||
with:
|
||||
api-key: ${{ secrets.CI_LINGO_DOT_DEV_API_KEY }}
|
||||
pull-request: true
|
||||
|
||||
@@ -6,16 +6,27 @@ on:
|
||||
tags:
|
||||
- "*"
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
|
||||
jobs:
|
||||
release:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Generate GitHub App token
|
||||
id: generate-token
|
||||
uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
|
||||
with:
|
||||
app-id: ${{ secrets.CI_CAL_APP_ID }}
|
||||
private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
|
||||
repositories: 'cal.com'
|
||||
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
ref: 'main'
|
||||
token: ${{ secrets.GH_ACCESS_TOKEN }}
|
||||
token: ${{ steps.generate-token.outputs.token }}
|
||||
|
||||
- name: Configure git
|
||||
run: |
|
||||
|
||||
@@ -13,12 +13,20 @@ jobs:
|
||||
HTML_REPORT_URL_PATH: reports/${{ github.head_ref }}/${{ github.run_id }}/${{ github.run_attempt }}
|
||||
BRANCH_REPORTS_DIR: reports/${{ github.head_ref }}
|
||||
steps:
|
||||
- name: Generate GitHub App token
|
||||
id: generate-token
|
||||
uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
|
||||
with:
|
||||
app-id: ${{ secrets.CI_CAL_APP_ID }}
|
||||
private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
|
||||
repositories: 'test-results-2'
|
||||
|
||||
- name: Checkout GitHub Pages Branch
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: calcom/test-results-2
|
||||
ref: gh-pages
|
||||
token: ${{ secrets.GH_ACCESS_TOKEN }}
|
||||
token: ${{ steps.generate-token.outputs.token }}
|
||||
- name: Set Git User
|
||||
# see: https://github.com/actions/checkout/issues/13#issuecomment-724415212
|
||||
run: |
|
||||
|
||||
Reference in New Issue
Block a user