Reduce usage of admin token

[blink1073]

• Add a separate personal_access_token that is only used for the direct push to the target branch, otherwise use the user's token.
• Add docs that recommend the use of a fine-grained access token in an environment for publish_release
• Add test for pr ci trigger and personal access token
• Test against a scratch repo

[blink1073]

Okay, it turns out this truly isn't possible if branch protections are on. You get something like:

remote: error: GH006: Protected branch update failed for refs/heads/main.
remote: error: Changes must be made through a pull request. Required status check "test" is expected.

Even if the user running the workflow is an admin.

https://github.com/blink1073/test-python-project/actions/runs/7521308670/job/20471980190

[blink1073]

Back to the drawing board:

• Each org enables Fine-grained personal access tokens.
• Each repo has an admin-managed scoped access token that must expire every 90 days
• Any admin can go and create a new access token (or regenerate the old one) and update the secret in the repo

[blink1073]

TODO: remove personal_access_token in favor of using an environment secret and using the same token for the whole publish step - this makes things easier on both ends, and the token is still needed either way.

[ElioDiNino]

Is there any way to get the current workflows to work while branch protections are enabled? I can't seem to get it working since skipping just the commit with the changelog and package.json update is coupled with the new tag push.

[blink1073]

Hi @ElioDiNino, if you ADMIN_GITHUB_TOKEN has admin permissions on the repo and you haven't selected this option it should work:

[ElioDiNino]

Hi @ElioDiNino, if you ADMIN_GITHUB_TOKEN has admin permissions on the repo and you haven't selected this option it should work:

Hmm okay, I will try disabling that thanks. I am actually using a GitHub app and generating a token for it in place of using a PAT so that may also be causing issues

[blink1073]

This picked up some conflicts and has some work that needs to be removed, going to start a fresh PR.