Skip to content

Use GitHub App token in update workflows #54

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
rujche wants to merge 6 commits into from
Closed

Use GitHub App token in update workflows #54

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
2734a3a
Use GitHub App token in update workflows
rujche Jul 1, 2026
3b748ed
Pin GitHub Actions to immutable SHAs
rujche Jul 1, 2026
c6ee1e3
Use fixed release tags for GitHub Actions
rujche Jul 1, 2026
42beb66
Harden GitHub App token scope and checkout creds
rujche Jul 1, 2026
c8365b7
Fix hyphenated composite action input references
rujche Jul 1, 2026
b34b647
Use triggering ref for same-repo workflow checkout
rujche Jul 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions .github/actions/github-app-token/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
name: GitHub App Token
description: Generate a GitHub App installation token for workflows.
inputs:
app-id:
description: GitHub App ID
required: true
private-key:
description: GitHub App private key
required: true
owner:
description: Installation owner
required: false
default: Azure
repositories:
description: Comma or newline separated list of repository names for token scoping
required: false
default: azure-sdk-for-java
outputs:
token:
description: GitHub App installation token
value: ${{ steps.app-token.outputs.token }}
runs:
using: composite
steps:
- name: Generate GitHub App Token
id: app-token
uses: actions/create-github-app-token@v3.2.0
with:
app-id: ${{ inputs.app-id }}
private-key: ${{ inputs.private-key }}
owner: ${{ inputs.owner }}
repositories: ${{ inputs.repositories }}
Comment thread
rujche marked this conversation as resolved.
Outdated
24 changes: 16 additions & 8 deletions .github/workflows/test-spring-boot-rc-version.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,16 @@ jobs:
name: Build
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/checkout@v4
with:
repository: 'Azure/spring-cloud-azure-tools'
Comment thread
rujche marked this conversation as resolved.
Outdated
- name: Generate GitHub App Token
id: app-token
uses: ./.github/actions/github-app-token
with:
app-id: ${{ secrets.GH_APP_ID }}
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
repositories: azure-sdk-for-java
- name: Generate Version File
run: |
mvn compile
Expand All @@ -35,14 +42,15 @@ jobs:
else
echo "No RC version,cancel update!"
fi
- uses: actions/checkout@v3
- uses: actions/checkout@v4
if: ${{ env.need_update_version == 'true' }}
with:
repository: 'Azure/azure-sdk-for-java'
path: 'azure-sdk-for-java'
ref: main
token: ${{ secrets.ACCESS_TOKEN }}
token: ${{ steps.app-token.outputs.token }}
Comment thread
rujche marked this conversation as resolved.
fetch-depth: 1
persist-credentials: false
- name: Generate spring_boot_managed_external_dependencies.txt
if: ${{ env.need_update_version == 'true' }}
run: |
Expand Down Expand Up @@ -81,23 +89,23 @@ jobs:
cp -f ../spring-cloud-azure-supported-spring.json sdk/spring/pipeline
git add sdk/spring/pipeline/spring-cloud-azure-supported-spring.json
git commit -m "Upgrade spring-cloud-azure-supported-spring"
git push "https://${{ secrets.USER }}:${{ secrets.ACCESS_TOKEN }}@github.com/${{ secrets.USER }}/azure-sdk-for-java.git" "HEAD:${{ env.update_branch }}"
git push "https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/Azure/azure-sdk-for-java.git" "HEAD:${{ env.update_branch }}"
- name: Create Pull Request
if: ${{ env.need_update_version == 'true' }}
uses: vsoch/pull-request-action@master
uses: vsoch/pull-request-action@1.1.1
env:
PULL_REQUEST_TOKEN: ${{ secrets.ACCESS_TOKEN }}
PULL_REQUEST_TOKEN: ${{ steps.app-token.outputs.token }}
PULL_REQUEST_REPOSITORY: Azure/azure-sdk-for-java
PULL_REQUEST_TITLE: "${{ env.PR_TITLE }}"
PULL_REQUEST_FROM_BRANCH: "${{ secrets.USER }}:${{ env.update_branch }}"
PULL_REQUEST_FROM_BRANCH: "${{ env.update_branch }}"
PULL_REQUEST_BRANCH: "main"
PULL_REQUEST_BODY: "Test Spring Boot RC version [${{ env.spring_boot_version }}](https://repo1.maven.org/maven2/org/springframework/boot/spring-boot-dependencies/${{ env.spring_boot_version }}/spring-boot-dependencies-${{ env.spring_boot_version }}.pom) and Spring Cloud version [${{ env.spring_cloud_version }}](https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-dependencies/${{ env.spring_cloud_version }}/spring-cloud-dependencies-${{ env.spring_cloud_version }}.pom).\n${{ env.pr_descriptions }}\n\nThis PR is created by GitHub Actions: https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}"
PULL_REQUEST_DRAFT: true
- name: Comment on Pull Requests
if: ${{ env.need_update_version == 'true' }}
uses: actions/github-script@v7
with:
github-token: ${{ secrets.ACCESS_TOKEN }}
github-token: ${{ steps.app-token.outputs.token }}
script: |
const { data: pullRequests } = await github.rest.pulls.list({
owner: 'Azure',
Expand Down
36 changes: 27 additions & 9 deletions .github/workflows/update-spring-cloud-azure-support-file.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,11 +13,21 @@ jobs:
outputs:
has_open_pr: ${{ steps.check.outputs.has_open_pr }}
steps:
- uses: actions/checkout@v4
with:
repository: 'Azure/spring-cloud-azure-tools'
Comment thread
rujche marked this conversation as resolved.
Outdated
- name: Generate GitHub App Token
id: app-token
uses: ./.github/actions/github-app-token
with:
app-id: ${{ secrets.GH_APP_ID }}
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
repositories: azure-sdk-for-java
- name: Check for Existing Open Pull Request
id: check
uses: actions/github-script@v7
with:
github-token: ${{ secrets.ACCESS_TOKEN }}
github-token: ${{ steps.app-token.outputs.token }}
script: |
const prTitle = process.env.PR_TITLE;
const { data: pullRequests } = await github.rest.pulls.list({
Expand All @@ -41,20 +51,28 @@ jobs:
if: ${{ needs.check-open-pr.outputs.has_open_pr == 'false' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/checkout@v4
with:
repository: 'Azure/spring-cloud-azure-tools'
Comment thread
rujche marked this conversation as resolved.
Outdated
- name: Generate GitHub App Token
id: app-token
uses: ./.github/actions/github-app-token
with:
app-id: ${{ secrets.GH_APP_ID }}
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
repositories: azure-sdk-for-java
- name: Generate Spring Cloud Azure Support File
run: |
mvn compile
mvn exec:java -P github-actions -ntp -Dupdate-spring-cloud-azure-support-file=true
- uses: actions/checkout@v3
- uses: actions/checkout@v4
with:
repository: 'Azure/azure-sdk-for-java'
path: 'azure-sdk-for-java'
ref: main
token: ${{ secrets.ACCESS_TOKEN }}
token: ${{ steps.app-token.outputs.token }}
Comment thread
rujche marked this conversation as resolved.
fetch-depth: 0
persist-credentials: false
- name: Set Branch Name with Timestamp
run: |
TIMESTAMP=$(date +%Y%m%d-%H%M%S)
Expand Down Expand Up @@ -126,23 +144,23 @@ jobs:
git add sdk/spring/pipeline/spring-cloud-azure-supported-spring.json
git add docs/spring/Spring-Cloud-Azure-Timeline.md
git commit -m "${{ env.COMMIT_MESSAGE }}"
git push "https://${{ secrets.USER }}:${{ secrets.ACCESS_TOKEN }}@github.com/${{ secrets.USER }}/azure-sdk-for-java.git"
git push "https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/Azure/azure-sdk-for-java.git" "${{ env.BRANCH_NAME }}"
- name: Create Pull Request
id: create_pr
if: ${{ env.NEED_UPDATE_FILE == 'true' }}
uses: vsoch/pull-request-action@master
uses: vsoch/pull-request-action@1.1.1
env:
PULL_REQUEST_TOKEN: ${{ secrets.ACCESS_TOKEN }}
PULL_REQUEST_TOKEN: ${{ steps.app-token.outputs.token }}
PULL_REQUEST_REPOSITORY: Azure/azure-sdk-for-java
PULL_REQUEST_TITLE: "${{ env.PR_TITLE }}"
PULL_REQUEST_FROM_BRANCH: "${{ secrets.USER }}:${{ env.BRANCH_NAME }}"
PULL_REQUEST_FROM_BRANCH: "${{ env.BRANCH_NAME }}"
PULL_REQUEST_BRANCH: "main"
PULL_REQUEST_BODY: "${{ env.PULL_REQUEST_BODY }}"
- name: Comment on Pull Requests
if: ${{ env.NEED_UPDATE_FILE == 'true' }}
uses: actions/github-script@v7
with:
github-token: ${{ secrets.ACCESS_TOKEN }}
github-token: ${{ steps.app-token.outputs.token }}
script: |
const prNumber = '${{ steps.create_pr.outputs.pull_request_number }}';

Expand Down
36 changes: 27 additions & 9 deletions .github/workflows/update-spring-dependencies.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,11 +19,21 @@ jobs:
outputs:
skip_pipeline: ${{ steps.check_prs.outputs.skip_pipeline }}
steps:
- uses: actions/checkout@v4
with:
repository: 'Azure/spring-cloud-azure-tools'
Comment thread
rujche marked this conversation as resolved.
Outdated
- name: Generate GitHub App Token
id: app-token
uses: ./.github/actions/github-app-token
with:
app-id: ${{ secrets.GH_APP_ID }}
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
repositories: azure-sdk-for-java
- name: Check for Open Spring Boot Upgrade PRs
id: check_prs
uses: actions/github-script@v7
with:
github-token: ${{ secrets.ACCESS_TOKEN }}
github-token: ${{ steps.app-token.outputs.token }}
script: |
const prTitlePrefix = process.env.PR_TITLE_PREFIX;
const { data: pullRequests } = await github.rest.pulls.list({
Expand Down Expand Up @@ -51,9 +61,16 @@ jobs:
needs: check
if: ${{ needs.check.outputs.skip_pipeline != 'true' }}
steps:
- uses: actions/checkout@v3
- uses: actions/checkout@v4
with:
repository: 'Azure/spring-cloud-azure-tools'
Comment thread
rujche marked this conversation as resolved.
Outdated
- name: Generate GitHub App Token
id: app-token
uses: ./.github/actions/github-app-token
with:
app-id: ${{ secrets.GH_APP_ID }}
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
repositories: azure-sdk-for-java
- name: Generate Version File
run: |
mvn compile
Expand All @@ -74,14 +91,15 @@ jobs:
echo "pr_descriptions=$(cat pr-descriptions.txt)" >> $GITHUB_ENV
echo "PR_TITLE=${PR_TITLE_PREFIX} $(sed -n '1p' spring-versions.txt) and Spring Cloud $(sed -n '2p' spring-versions.txt)" >> $GITHUB_ENV
fi
- uses: actions/checkout@v3
- uses: actions/checkout@v4
if: ${{ env.need_update_version == 'true' }}
with:
repository: 'Azure/azure-sdk-for-java'
path: 'azure-sdk-for-java'
ref: main
token: ${{ secrets.ACCESS_TOKEN }}
token: ${{ steps.app-token.outputs.token }}
Comment thread
rujche marked this conversation as resolved.
fetch-depth: 1
persist-credentials: false
- name: Generate spring_boot_managed_external_dependencies.txt
if: ${{ env.need_update_version == 'true' }}
run: |
Expand Down Expand Up @@ -117,24 +135,24 @@ jobs:
git rm ./sdk/spring/scripts/spring_boot_${{ env.last_spring_boot_version }}_managed_external_dependencies.txt
git add -A
git commit -m "Upgrade external dependencies to align with Spring Boot ${{ env.spring_boot_version }}"
git push "https://${{ secrets.USER }}:${{ secrets.ACCESS_TOKEN }}@github.com/${{ secrets.USER }}/azure-sdk-for-java.git" "HEAD:${{ env.update_branch }}"
git push "https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/Azure/azure-sdk-for-java.git" "HEAD:${{ env.update_branch }}"
- name: Create Pull Request
id: create_pr
if: ${{ env.need_update_version == 'true' }}
uses: vsoch/pull-request-action@master
uses: vsoch/pull-request-action@1.1.1
env:
PULL_REQUEST_TOKEN: ${{ secrets.ACCESS_TOKEN }}
PULL_REQUEST_TOKEN: ${{ steps.app-token.outputs.token }}
PULL_REQUEST_REPOSITORY: Azure/azure-sdk-for-java
PULL_REQUEST_TITLE: "${{ env.PR_TITLE }}"
PULL_REQUEST_FROM_BRANCH: "${{ secrets.USER }}:${{ env.update_branch }}"
PULL_REQUEST_FROM_BRANCH: "${{ env.update_branch }}"
PULL_REQUEST_BRANCH: "main"
PULL_REQUEST_BODY: "Updates external dependencies to align with Spring Boot version [${{ env.spring_boot_version }}](https://repo1.maven.org/maven2/org/springframework/boot/spring-boot-dependencies/${{ env.spring_boot_version }}/spring-boot-dependencies-${{ env.spring_boot_version }}.pom) from [${{ env.last_spring_boot_version }}](https://repo1.maven.org/maven2/org/springframework/boot/spring-boot-dependencies/${{ env.last_spring_boot_version }}/spring-boot-dependencies-${{ env.last_spring_boot_version }}.pom) and Spring Cloud version [${{ env.spring_cloud_version }}](https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-dependencies/${{ env.spring_cloud_version }}/spring-cloud-dependencies-${{ env.spring_cloud_version }}.pom) from [${{ env.last_spring_cloud_version }}](https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-dependencies/${{ env.last_spring_cloud_version }}/spring-cloud-dependencies-${{ env.last_spring_cloud_version }}.pom).\n${{ env.pr_descriptions }}\n\nThis PR is created by GitHub Actions: https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}"
PULL_REQUEST_DRAFT: false
- name: Comment on Pull Requests
if: ${{ env.need_update_version == 'true' }}
uses: actions/github-script@v7
with:
github-token: ${{ secrets.ACCESS_TOKEN }}
github-token: ${{ steps.app-token.outputs.token }}
script: |
const prNumber = '${{ steps.create_pr.outputs.pull_request_number }}';

Expand Down
Loading