diff --git a/.github/actions/composite/setupGitForOSBotify/action.yml b/.github/actions/composite/setupGitForOSBotify/action.yml index 2a3bb50cfb0f..0c06e2f4e169 100644 --- a/.github/actions/composite/setupGitForOSBotify/action.yml +++ b/.github/actions/composite/setupGitForOSBotify/action.yml @@ -1,17 +1,11 @@ -name: "Setup Git for OSBotify" -description: "Setup Git for OSBotify" +name: 'Setup Git for OSBotify' +description: 'Setup Git for OSBotify' inputs: GPG_PASSPHRASE: - description: "Passphrase used to decrypt GPG key" + description: 'Passphrase used to decrypt GPG key' required: true -outputs: - # Do not try to use this for committing code. Use `secrets.OS_BOTIFY_COMMIT_TOKEN` instead - OS_BOTIFY_API_TOKEN: - description: Token to use for GitHub API interactions. - value: ${{ steps.generateToken.outputs.token }} - runs: using: composite steps: @@ -35,11 +29,3 @@ runs: shell: bash if: runner.debug == '1' run: echo "GIT_TRACE=true" >> "$GITHUB_ENV" - - - name: Generate a token - id: generateToken - uses: tibdex/github-app-token@021a2405c7f990db57f5eae5397423dcc554159c - with: - app_id: ${{ secrets.OS_BOTIFY_APP_ID }} - private_key: ${{ secrets.OS_BOTIFY_PRIVATE_KEY }} - installation_id: ${{ secrets.OS_BOTIFY_INSTALLATION_ID }} diff --git a/.github/workflows/createNewVersion.yml b/.github/workflows/createNewVersion.yml index 298d9d2f7eba..b2703731df79 100644 --- a/.github/workflows/createNewVersion.yml +++ b/.github/workflows/createNewVersion.yml @@ -26,15 +26,12 @@ on: LARGE_SECRET_PASSPHRASE: description: Passphrase used to decrypt GPG key required: true + OS_BOTIFY_TOKEN: + description: Token for the OSBotify user + required: true SLACK_WEBHOOK: description: Webhook used to comment in slack required: true - OS_BOTIFY_INSTALLATION_ID: - description: Installation ID for OS Botify App - required: true - OS_BOTIFY_COMMIT_TOKEN: - description: OSBotify personal access token, used to workaround committing to protected branch - required: true jobs: validateActor: @@ -46,7 +43,7 @@ jobs: id: getUserPermissions run: echo "PERMISSION=$(gh api /repos/${{ github.repository }}/collaborators/${{ github.actor }}/permission | jq -r '.permission')" >> "$GITHUB_OUTPUT" env: - GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_COMMIT_TOKEN }} + GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} createNewVersion: runs-on: macos-latest @@ -66,12 +63,9 @@ jobs: - uses: actions/checkout@v3 with: ref: main - # The OS_BOTIFY_COMMIT_TOKEN is a personal access token tied to osbotify - # This is a workaround to allow pushes to a protected branch - token: ${{ secrets.OS_BOTIFY_COMMIT_TOKEN }} + token: ${{ secrets.OS_BOTIFY_TOKEN }} - uses: Expensify/App/.github/actions/composite/setupGitForOSBotify@main - id: setupGitForOSBotify with: GPG_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }} @@ -79,7 +73,7 @@ jobs: id: bumpVersion uses: Expensify/App/.github/actions/javascript/bumpVersion@main with: - GITHUB_TOKEN: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }} + GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} SEMVER_LEVEL: ${{ inputs.SEMVER_LEVEL }} - name: Commit new version diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 1ccb1d2ccdfd..b3105ee05c2c 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -9,16 +9,15 @@ jobs: runs-on: ubuntu-latest if: github.ref == 'refs/heads/staging' steps: - - uses: Expensify/App/.github/actions/composite/setupGitForOSBotify@main - id: setupGitForOSBotify - with: - GPG_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }} - - name: Checkout staging branch uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 with: ref: staging - token: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }} + token: ${{ secrets.OS_BOTIFY_TOKEN }} + + - uses: Expensify/App/.github/actions/composite/setupGitForOSBotify@main + with: + GPG_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }} - name: Tag version run: git tag "$(npm run print-version --silent)" @@ -30,15 +29,10 @@ jobs: runs-on: ubuntu-latest if: github.ref == 'refs/heads/production' steps: - - uses: Expensify/App/.github/actions/composite/setupGitForOSBotify@main - id: setupGitForOSBotify - with: - GPG_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }} - - uses: actions/checkout@v3 with: ref: production - token: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }} + token: ${{ secrets.OS_BOTIFY_TOKEN }} - uses: Expensify/App/.github/actions/composite/setupGitForOSBotify@main with: @@ -52,7 +46,7 @@ jobs: uses: Expensify/App/.github/actions/javascript/getDeployPullRequestList@main with: TAG: ${{ env.PRODUCTION_VERSION }} - GITHUB_TOKEN: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }} + GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} IS_PRODUCTION_DEPLOY: true - name: Generate Release Body @@ -67,4 +61,4 @@ jobs: tag_name: ${{ env.PRODUCTION_VERSION }} body: ${{ steps.getReleaseBody.outputs.RELEASE_BODY }} env: - GITHUB_TOKEN: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }} + GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} diff --git a/.github/workflows/finishReleaseCycle.yml b/.github/workflows/finishReleaseCycle.yml index c80b235277ad..b78a5fac4b69 100644 --- a/.github/workflows/finishReleaseCycle.yml +++ b/.github/workflows/finishReleaseCycle.yml @@ -12,11 +12,6 @@ jobs: outputs: isValid: ${{ fromJSON(steps.isDeployer.outputs.IS_DEPLOYER) && !fromJSON(steps.checkDeployBlockers.outputs.HAS_DEPLOY_BLOCKERS) }} steps: - - uses: Expensify/App/.github/actions/composite/setupGitForOSBotify@main - id: setupGitForOSBotify - with: - GPG_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }} - - name: Validate actor is deployer id: isDeployer run: | @@ -26,13 +21,13 @@ jobs: echo "IS_DEPLOYER=false" >> "$GITHUB_OUTPUT" fi env: - GITHUB_TOKEN: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }} + GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} - name: Reopen and comment on issue if: ${{ !fromJSON(steps.isDeployer.outputs.IS_DEPLOYER) }} uses: Expensify/App/.github/actions/javascript/reopenIssueWithComment@main with: - GITHUB_TOKEN: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }} + GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} ISSUE_NUMBER: ${{ github.event.issue.number }} COMMENT: | Sorry, only members of @Expensify/Mobile-Deployers can close deploy checklists. @@ -43,14 +38,14 @@ jobs: id: checkDeployBlockers uses: Expensify/App/.github/actions/javascript/checkDeployBlockers@main with: - GITHUB_TOKEN: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }} + GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} ISSUE_NUMBER: ${{ github.event.issue.number }} - name: Reopen and comment on issue if: ${{ fromJSON(steps.isDeployer.outputs.IS_DEPLOYER) && fromJSON(steps.checkDeployBlockers.outputs.HAS_DEPLOY_BLOCKERS) }} uses: Expensify/App/.github/actions/javascript/reopenIssueWithComment@main with: - GITHUB_TOKEN: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }} + GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} ISSUE_NUMBER: ${{ github.event.issue.number }} COMMENT: | This issue either has unchecked items or has not yet been marked with the `:shipit:` emoji of approval. @@ -73,7 +68,6 @@ jobs: token: ${{ secrets.OS_BOTIFY_TOKEN }} - uses: Expensify/App/.github/actions/composite/setupGitForOSBotify@main - id: setupGitForOSBotify with: GPG_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }} @@ -131,15 +125,10 @@ jobs: runs-on: ubuntu-latest needs: [updateStaging, createNewPatchVersion] steps: - - uses: Expensify/App/.github/actions/composite/setupGitForOSBotify@main - id: setupGitForOSBotify - with: - GPG_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }} - - uses: actions/checkout@v3 with: ref: staging - token: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }} + token: ${{ secrets.OS_BOTIFY_TOKEN }} # Create a local git tag so that GitUtils.getPullRequestsMergedBetween can use `git log` to generate a # list of pull requests that were merged between this version tag and another. @@ -151,7 +140,7 @@ jobs: - name: Create new StagingDeployCash uses: Expensify/App/.github/actions/javascript/createOrUpdateStagingDeploy@main with: - GITHUB_TOKEN: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }} + GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} NPM_VERSION: ${{ needs.createNewPatchVersion.outputs.NEW_VERSION }} - if: ${{ failure() }}