infra(release): use PAT for releases

faker-js · Jul 24, 2024 · ee22bba · ee22bba
1 parent 5b32959
commit ee22bba
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 6 deletions.
diff --git a/.github/workflows/prepare-release-pr.yml b/.github/workflows/prepare-release-pr.yml
@@ -15,8 +15,7 @@ on:
           - rc
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   prepare_release_pr:
@@ -46,8 +45,8 @@ jobs:
 
       - name: Run release
         run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config user.name "FakerJS Bot"
+          git config user.email "github-bot@fakerjs.dev"
           if [ $RELEASE_TYPE = 'stable' ]; then
             pnpm run release
           else
@@ -63,7 +62,10 @@ jobs:
           RELEASE_BRANCH="chore/release/$RELEASE_VERSION"
           echo "RELEASE_BRANCH=$RELEASE_BRANCH" >> $GITHUB_ENV
           git switch -c $RELEASE_BRANCH
+          git remote set-url origin https://${GH_TOKEN}@github.com/faker-js/faker
           git push origin $RELEASE_BRANCH -f
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}
 
       - name: Create draft PR
         run: |
@@ -82,4 +84,4 @@ jobs:
           - Checklist: TODO add link to issue
           "
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
@@ -5,7 +5,7 @@ on:
     types: [published]
 
 permissions:
-  contents: write # to push the release branch
+  contents: read
 
 jobs:
   publish:
@@ -63,4 +63,7 @@ jobs:
 
       - name: Push to Release Branch
         run: |
+          git remote set-url origin https://${GH_TOKEN}@github.com/faker-js/faker
           git push origin $GITHUB_REF_NAME:v$RELEASE_MAJOR
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}