Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replace obsolete 'Generate Token' step, thanks to improved Scala Steward GitHub Action support #46

Merged
merged 1 commit into from
Jun 9, 2023

Conversation

rtyley
Copy link
Member

@rtyley rtyley commented Jun 2, 2023

(initially raised as #44)

scala-steward-org/scala-steward-action#428 updated Scala Steward's GitHub Action to have its own support for GitHub App authentication, meaning we can remove the additional 'Generate token' step from our GitHub Action workflow, with these benefits:

  • No longer need to use the tibdex/github-app-token - one fewer action we need to trust!
  • Running the Scala Steward action on a repo no longer requires adding the repo to REPOSITORIES.md - only granting the installation access to the repo is required:
    image
    • I've reduced REPOSITORIES.md to just the repos that have custom configuration (eg the :dependency-updates suffix in guardian/amigo:dependency-updates).

Testing

I've test-run the workflow against this branch, and it succeeded:

https://github.com/guardian/scala-steward-public-repos/actions/runs/5154533830

@@ -11,5 +11,6 @@ jobs:
uses: ./.github/workflows/reusable-scala-steward.yml
with:
app_id: 214238
app_installation_id: 26822732
Copy link
Member Author

@rtyley rtyley Jun 2, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One surprise here is that with moving from tibdex/github-app-token to scala-steward-org/scala-steward-action for App authentication, we now need to also supply the github-app-installation-id, where previously we didn't.

In the Scala Steward action, both 'app' & 'installation' tokens seem to get used - so far as I can see, the 'app' is used for performing actions as the bot, while 'installation' is used for in the Scala Steward workspace - I think for cloning the required GitHub repos.

In our case, because we own both the app and the installation, the distinction probably doesn't help us very much, but I imagine it's useful if you're an organisation like VirtusLab, who run Scala Steward on other organisations repositories as a service.

Working on #44 -
now that scala-steward-org/scala-steward-action#428
updated the Scala Steward GitHub Action to have its _own_ support for
GitHub App authentication, we can remove the additional 'Generate token'
step from our GitHub Action workflow, with these benefits:

* No longer need to use the tibdex/github-app-token - one fewer action
  we need to trust!
* Running the Scala Steward action on a repo no longer requires adding the
  repo to REPOSITORIES.md - only granting the installation access to the
  repo is required.
@rtyley rtyley force-pushed the remove-obsolete-generate-token-step branch from 83c6d14 to 0869772 Compare June 2, 2023 16:50
@rtyley rtyley requested a review from NovemberTang June 7, 2023 09:08
@rtyley rtyley merged commit 2c3ae97 into main Jun 9, 2023
@rtyley rtyley deleted the remove-obsolete-generate-token-step branch June 9, 2023 14:55
@rtyley rtyley mentioned this pull request Dec 7, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants