infra(release): use PAT for releases

faker-js · Jul 24, 2024 · 7c8d286 · 7c8d286
1 parent 5b32959
commit 7c8d286
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 6 deletions.
diff --git a/.github/workflows/prepare-release-pr.yml b/.github/workflows/prepare-release-pr.yml
@@ -15,8 +15,7 @@ on:
           - rc
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   prepare_release_pr:
@@ -29,6 +28,7 @@ jobs:
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           fetch-depth: 0
+          token: ${{ secrets.GH_TOKEN }}
 
       - name: Install pnpm
         uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # v4.0.0
@@ -46,8 +46,8 @@ jobs:
 
       - name: Run release
         run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config user.name "FakerJS Bot"
+          git config user.email "github-bot@fakerjs.dev"
           if [ $RELEASE_TYPE = 'stable' ]; then
             pnpm run release
           else
@@ -63,7 +63,10 @@ jobs:
           RELEASE_BRANCH="chore/release/$RELEASE_VERSION"
           echo "RELEASE_BRANCH=$RELEASE_BRANCH" >> $GITHUB_ENV
           git switch -c $RELEASE_BRANCH
+          git remote set-url origin https://fakerjs-bot:${GH_TOKEN}@github.com/faker-js/faker
           git push origin $RELEASE_BRANCH -f
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}
 
       - name: Create draft PR
         run: |
@@ -82,4 +85,4 @@ jobs:
           - Checklist: TODO add link to issue
           "
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
@@ -5,7 +5,7 @@ on:
     types: [published]
 
 permissions:
-  contents: write # to push the release branch
+  contents: read
 
 jobs:
   publish:
@@ -63,4 +63,7 @@ jobs:
 
       - name: Push to Release Branch
         run: |
+          git remote set-url origin https://fakerjs-bot:${GH_TOKEN}@github.com/faker-js/faker
           git push origin $GITHUB_REF_NAME:v$RELEASE_MAJOR
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}