Revert "Use installation token for OS Botify"

.github/actions/composite/setupGitForOSBotify/action.yml

@@ -1,17 +1,11 @@
-name: "Setup Git for OSBotify"
-description: "Setup Git for OSBotify"
+name: 'Setup Git for OSBotify'
+description: 'Setup Git for OSBotify'
 
 inputs:
   GPG_PASSPHRASE:
-    description: "Passphrase used to decrypt GPG key"
+    description: 'Passphrase used to decrypt GPG key'
     required: true
 
-outputs:
-  # Do not try to use this for committing code. Use `secrets.OS_BOTIFY_COMMIT_TOKEN` instead
-  OS_BOTIFY_API_TOKEN:
-    description: Token to use for GitHub API interactions.
-    value: ${{ steps.generateToken.outputs.token }}
-
 runs:
   using: composite
   steps:
@@ -35,11 +29,3 @@ runs:
       shell: bash
       if: runner.debug == '1'
       run: echo "GIT_TRACE=true" >> "$GITHUB_ENV"
-
-    - name: Generate a token
-      id: generateToken
-      uses: tibdex/github-app-token@021a2405c7f990db57f5eae5397423dcc554159c
-      with:
-        app_id: ${{ secrets.OS_BOTIFY_APP_ID }}
-        private_key: ${{ secrets.OS_BOTIFY_PRIVATE_KEY }}
-        installation_id: ${{ secrets.OS_BOTIFY_INSTALLATION_ID }}

.github/workflows/createNewVersion.yml

@@ -26,15 +26,12 @@ on:
       LARGE_SECRET_PASSPHRASE:
         description: Passphrase used to decrypt GPG key
         required: true
+      OS_BOTIFY_TOKEN:
+        description: Token for the OSBotify user
+        required: true
       SLACK_WEBHOOK:
         description: Webhook used to comment in slack
         required: true
-      OS_BOTIFY_INSTALLATION_ID:
-        description: Installation ID for OS Botify App
-        required: true
-      OS_BOTIFY_COMMIT_TOKEN:
-        description: OSBotify personal access token, used to workaround committing to protected branch
-        required: true
 
 jobs:
   validateActor:
@@ -46,7 +43,7 @@ jobs:
         id: getUserPermissions
         run: echo "PERMISSION=$(gh api /repos/${{ github.repository }}/collaborators/${{ github.actor }}/permission | jq -r '.permission')" >> "$GITHUB_OUTPUT"
         env:
-          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_COMMIT_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
 
   createNewVersion:
     runs-on: macos-latest
@@ -66,20 +63,17 @@ jobs:
       - uses: actions/checkout@v3
         with:
           ref: main
-          # The OS_BOTIFY_COMMIT_TOKEN is a personal access token tied to osbotify
-          # This is a workaround to allow pushes to a protected branch
-          token: ${{ secrets.OS_BOTIFY_COMMIT_TOKEN }}
+          token: ${{ secrets.OS_BOTIFY_TOKEN }}
 
       - uses: Expensify/App/.github/actions/composite/setupGitForOSBotify@main
-        id: setupGitForOSBotify
         with:
           GPG_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }}
 
       - name: Generate version
         id: bumpVersion
         uses: Expensify/App/.github/actions/javascript/bumpVersion@main
         with:
-          GITHUB_TOKEN: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
           SEMVER_LEVEL: ${{ inputs.SEMVER_LEVEL }}
 
       - name: Commit new version

.github/workflows/deploy.yml

@@ -9,16 +9,15 @@ jobs:
     runs-on: ubuntu-latest
     if: github.ref == 'refs/heads/staging'
     steps:
-      - uses: Expensify/App/.github/actions/composite/setupGitForOSBotify@main
-        id: setupGitForOSBotify
-        with:
-          GPG_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }}
-
       - name: Checkout staging branch
         uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
         with:
           ref: staging
-          token: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }}
+          token: ${{ secrets.OS_BOTIFY_TOKEN }}
+
+      - uses: Expensify/App/.github/actions/composite/setupGitForOSBotify@main
+        with:
+          GPG_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }}
 
       - name: Tag version
         run: git tag "$(npm run print-version --silent)"
@@ -30,15 +29,10 @@ jobs:
     runs-on: ubuntu-latest
     if: github.ref == 'refs/heads/production'
     steps:
-      - uses: Expensify/App/.github/actions/composite/setupGitForOSBotify@main
-        id: setupGitForOSBotify
-        with:
-          GPG_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }}
-
       - uses: actions/checkout@v3
         with:
           ref: production
-          token: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }}
+          token: ${{ secrets.OS_BOTIFY_TOKEN }}
 
       - uses: Expensify/App/.github/actions/composite/setupGitForOSBotify@main
         with:
@@ -52,7 +46,7 @@ jobs:
         uses: Expensify/App/.github/actions/javascript/getDeployPullRequestList@main
         with:
           TAG: ${{ env.PRODUCTION_VERSION }}
-          GITHUB_TOKEN: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
           IS_PRODUCTION_DEPLOY: true
 
       - name: Generate Release Body
@@ -67,4 +61,4 @@ jobs:
           tag_name: ${{ env.PRODUCTION_VERSION }}
           body: ${{ steps.getReleaseBody.outputs.RELEASE_BODY }}
         env:
-          GITHUB_TOKEN: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}

.github/workflows/finishReleaseCycle.yml

@@ -12,11 +12,6 @@ jobs:
     outputs:
       isValid: ${{ fromJSON(steps.isDeployer.outputs.IS_DEPLOYER) && !fromJSON(steps.checkDeployBlockers.outputs.HAS_DEPLOY_BLOCKERS) }}
     steps:
-      - uses: Expensify/App/.github/actions/composite/setupGitForOSBotify@main
-        id: setupGitForOSBotify
-        with:
-          GPG_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }}
-
       - name: Validate actor is deployer
         id: isDeployer
         run: |
@@ -26,13 +21,13 @@ jobs:
             echo "IS_DEPLOYER=false" >> "$GITHUB_OUTPUT"
           fi
         env:
-          GITHUB_TOKEN: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
 
       - name: Reopen and comment on issue
         if: ${{ !fromJSON(steps.isDeployer.outputs.IS_DEPLOYER) }}
         uses: Expensify/App/.github/actions/javascript/reopenIssueWithComment@main
         with:
-          GITHUB_TOKEN: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
           ISSUE_NUMBER: ${{ github.event.issue.number }}
           COMMENT: |
             Sorry, only members of @Expensify/Mobile-Deployers can close deploy checklists.
@@ -43,14 +38,14 @@ jobs:
         id: checkDeployBlockers
         uses: Expensify/App/.github/actions/javascript/checkDeployBlockers@main
         with:
-          GITHUB_TOKEN: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
           ISSUE_NUMBER: ${{ github.event.issue.number }}
 
       - name: Reopen and comment on issue
         if: ${{ fromJSON(steps.isDeployer.outputs.IS_DEPLOYER) && fromJSON(steps.checkDeployBlockers.outputs.HAS_DEPLOY_BLOCKERS) }}
         uses: Expensify/App/.github/actions/javascript/reopenIssueWithComment@main
         with:
-          GITHUB_TOKEN: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
           ISSUE_NUMBER: ${{ github.event.issue.number }}
           COMMENT: |
             This issue either has unchecked items or has not yet been marked with the `:shipit:` emoji of approval.
@@ -73,7 +68,6 @@ jobs:
           token: ${{ secrets.OS_BOTIFY_TOKEN }}
 
       - uses: Expensify/App/.github/actions/composite/setupGitForOSBotify@main
-        id: setupGitForOSBotify
         with:
           GPG_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }}
 
@@ -131,15 +125,10 @@ jobs:
     runs-on: ubuntu-latest
     needs: [updateStaging, createNewPatchVersion]
     steps:
-      - uses: Expensify/App/.github/actions/composite/setupGitForOSBotify@main
-        id: setupGitForOSBotify
-        with:
-          GPG_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }}
-
       - uses: actions/checkout@v3
         with:
           ref: staging
-          token: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }}
+          token: ${{ secrets.OS_BOTIFY_TOKEN }}
 
         # Create a local git tag so that GitUtils.getPullRequestsMergedBetween can use `git log` to generate a
         # list of pull requests that were merged between this version tag and another.
@@ -151,7 +140,7 @@ jobs:
       - name: Create new StagingDeployCash
         uses: Expensify/App/.github/actions/javascript/createOrUpdateStagingDeploy@main
         with:
-          GITHUB_TOKEN: ${{ steps.setupGitForOSBotify.outputs.OS_BOTIFY_API_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
           NPM_VERSION: ${{ needs.createNewPatchVersion.outputs.NEW_VERSION }}
 
       - if: ${{ failure() }}