Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ci: use GitHub app for ephemeral tokens #406

Merged
merged 1 commit into from
Sep 25, 2024

Conversation

v1v
Copy link
Member

@v1v v1v commented Sep 17, 2024

What does this PR do?

Use the GitHub app to generate the required ephemeral tokens with the least permissive principle.

Why

  • Finer-grained tokens with Service Machine accounts are required to rotate the secrets manually.
  • GitHub app to generate temporary tokens is the advanced approach to avoid the above
  • Document what the GH workflow requires to run in terms of access
  • GitHub Token with Permissions does not trigger GitHub builds

Implementation details

Use tibdex/github-app-token with the required permissions and the repository scope
Remove the permissions configuration in the GH workflow.
Configure git checkout with the ephemeral token
Configure the GH_TOKEN with the ephemeral token

@v1v v1v requested review from a team September 17, 2024 11:08
@v1v v1v self-assigned this Sep 17, 2024
"pull_requests": "write"
}
repositories: >-
["elastic-otel-java"]
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could try with ${{github.event.repository.name}} instead of a hardcoded value, but need to figure out if those details are available when running this workflow.

For now we can use a hardcoded value

@v1v
Copy link
Member Author

v1v commented Sep 24, 2024

@elastic/apm-agent-java , I plan to merge in the next day or so, do you have any questions/concerns?

@v1v v1v merged commit e409bff into elastic:main Sep 25, 2024
16 checks passed
@v1v v1v deleted the feature/release-automation-1 branch September 25, 2024 08:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants