From 6108041ce4c5ccb341637a4f4bcddb6fb4ee18ea Mon Sep 17 00:00:00 2001 From: blam Date: Tue, 18 Jan 2022 14:29:16 +0100 Subject: [PATCH 1/9] chore: added get-workflow-token script Signed-off-by: blam --- .github/workflows/goalie.yaml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/goalie.yaml b/.github/workflows/goalie.yaml index 2303039c7f..90c84e671d 100644 --- a/.github/workflows/goalie.yaml +++ b/.github/workflows/goalie.yaml @@ -12,6 +12,12 @@ jobs: label: runs-on: ubuntu-latest steps: + - name: Get Token + id: get_workflow_token + uses: peter-murray/workflow-application-token-action@v1 + with: + application_id: ${{ secrets.BACKSTAGE_WORKFLOW_MEMBER_READ_APP_ID }} + application_private_key: ${{ secrets.BACKSTAGE_WORKFLOW_MEMBER_READ_PRIVATE_KEY }} - uses: actions/checkout@v2 - uses: actions/setup-node@v2 with: @@ -21,7 +27,7 @@ jobs: - uses: actions/github-script@v5 id: get-all-group-members with: - github-token: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN }} + github-token: ${{ steps.get_workflow_token.outputs.token }} script: | // Get all teams and their respective members const {data: teams} = await github.request('GET /orgs/{org}/teams', { From 08b7b16cb162ff694e235e30f0baaf3262eba7d2 Mon Sep 17 00:00:00 2001 From: blam Date: Tue, 18 Jan 2022 14:32:50 +0100 Subject: [PATCH 2/9] chore: updating permission for runing on forks Signed-off-by: blam i --- .github/workflows/goalie.yaml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/goalie.yaml b/.github/workflows/goalie.yaml index 90c84e671d..133e8c9a84 100644 --- a/.github/workflows/goalie.yaml +++ b/.github/workflows/goalie.yaml @@ -7,6 +7,10 @@ on: types: [created] pull_request: types: [opened, reopened, synchronize] + +permissions: + issues: write + pull-requests: read jobs: label: @@ -52,6 +56,7 @@ jobs: - uses: actions/github-script@v5 id: get-all-changed-files with: + github-token: ${{ github.token }} script: | const { data: allFiles } = await github.rest.pulls.listFiles({ owner: context.repo.owner, @@ -64,6 +69,7 @@ jobs: - uses: actions/github-script@v5 id: get-all-current-reviews with: + github-token: ${{ github.token }} script: | const { data: allReviews } = await github.rest.pulls.listReviews({ owner: context.repo.owner, @@ -76,7 +82,8 @@ jobs: - uses: actions/github-script@v5 id: fix-labels with: - script: | + github-token: ${{ github.token }} + script: | // if it's the author, always add awaiting-review label const isAuthor = context.payload.pull_request.user.login === context.actor if (isAuthor) { From 5a49582e93e5eebc0c1873b16c958d0ec5c37d2a Mon Sep 17 00:00:00 2001 From: blam Date: Tue, 18 Jan 2022 14:35:27 +0100 Subject: [PATCH 3/9] chore: fix syntax Signed-off-by: blam --- .github/workflows/goalie.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/goalie.yaml b/.github/workflows/goalie.yaml index 133e8c9a84..2dc1ba2b5a 100644 --- a/.github/workflows/goalie.yaml +++ b/.github/workflows/goalie.yaml @@ -7,7 +7,7 @@ on: types: [created] pull_request: types: [opened, reopened, synchronize] - + permissions: issues: write pull-requests: read @@ -82,8 +82,8 @@ jobs: - uses: actions/github-script@v5 id: fix-labels with: - github-token: ${{ github.token }} - script: | + github-token: ${{ github.token }} + script: | // if it's the author, always add awaiting-review label const isAuthor = context.payload.pull_request.user.login === context.actor if (isAuthor) { From 192a8bc84a8b0228513272e1ef527e8bb4a283cd Mon Sep 17 00:00:00 2001 From: blam Date: Tue, 18 Jan 2022 15:03:48 +0100 Subject: [PATCH 4/9] set the org as it's installed at an org level Signed-off-by: blam --- .github/workflows/goalie.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/goalie.yaml b/.github/workflows/goalie.yaml index 2dc1ba2b5a..3f105ed269 100644 --- a/.github/workflows/goalie.yaml +++ b/.github/workflows/goalie.yaml @@ -22,6 +22,7 @@ jobs: with: application_id: ${{ secrets.BACKSTAGE_WORKFLOW_MEMBER_READ_APP_ID }} application_private_key: ${{ secrets.BACKSTAGE_WORKFLOW_MEMBER_READ_PRIVATE_KEY }} + organization: backstage - uses: actions/checkout@v2 - uses: actions/setup-node@v2 with: From f44a185ab70878dfa530e3e50fdd8a23159cab57 Mon Sep 17 00:00:00 2001 From: blam Date: Tue, 18 Jan 2022 15:05:31 +0100 Subject: [PATCH 5/9] chore: maybe these tokens workflows Signed-off-by: blam --- .github/workflows/goalie.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/goalie.yaml b/.github/workflows/goalie.yaml index 3f105ed269..7427b9e18b 100644 --- a/.github/workflows/goalie.yaml +++ b/.github/workflows/goalie.yaml @@ -23,6 +23,7 @@ jobs: application_id: ${{ secrets.BACKSTAGE_WORKFLOW_MEMBER_READ_APP_ID }} application_private_key: ${{ secrets.BACKSTAGE_WORKFLOW_MEMBER_READ_PRIVATE_KEY }} organization: backstage + - uses: actions/checkout@v2 - uses: actions/setup-node@v2 with: @@ -57,7 +58,6 @@ jobs: - uses: actions/github-script@v5 id: get-all-changed-files with: - github-token: ${{ github.token }} script: | const { data: allFiles } = await github.rest.pulls.listFiles({ owner: context.repo.owner, @@ -70,7 +70,6 @@ jobs: - uses: actions/github-script@v5 id: get-all-current-reviews with: - github-token: ${{ github.token }} script: | const { data: allReviews } = await github.rest.pulls.listReviews({ owner: context.repo.owner, @@ -83,7 +82,6 @@ jobs: - uses: actions/github-script@v5 id: fix-labels with: - github-token: ${{ github.token }} script: | // if it's the author, always add awaiting-review label const isAuthor = context.payload.pull_request.user.login === context.actor From 5ca2edfcb9850046e1470f280e2afe0aa1a228dc Mon Sep 17 00:00:00 2001 From: blam Date: Tue, 18 Jan 2022 15:09:05 +0100 Subject: [PATCH 6/9] chore: try this token? Signed-off-by: blam --- .github/workflows/goalie.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/goalie.yaml b/.github/workflows/goalie.yaml index 7427b9e18b..bdf355d16d 100644 --- a/.github/workflows/goalie.yaml +++ b/.github/workflows/goalie.yaml @@ -82,6 +82,7 @@ jobs: - uses: actions/github-script@v5 id: fix-labels with: + github-token: ${{ env.GITHUB_TOKEN }} script: | // if it's the author, always add awaiting-review label const isAuthor = context.payload.pull_request.user.login === context.actor From 9bfe00c3510e3427a4ecacb546f9475318753e0c Mon Sep 17 00:00:00 2001 From: blam Date: Tue, 18 Jan 2022 15:11:24 +0100 Subject: [PATCH 7/9] chore: spoiler alert, it's a secret Signed-off-by: blam --- .github/workflows/goalie.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/goalie.yaml b/.github/workflows/goalie.yaml index bdf355d16d..c36122f427 100644 --- a/.github/workflows/goalie.yaml +++ b/.github/workflows/goalie.yaml @@ -82,7 +82,7 @@ jobs: - uses: actions/github-script@v5 id: fix-labels with: - github-token: ${{ env.GITHUB_TOKEN }} + github-token: ${{ secrets.GITHUB_TOKEN }} script: | // if it's the author, always add awaiting-review label const isAuthor = context.payload.pull_request.user.login === context.actor From 08923f548fb72b02952d6856a428da21c220bd66 Mon Sep 17 00:00:00 2001 From: blam Date: Tue, 18 Jan 2022 15:12:36 +0100 Subject: [PATCH 8/9] chore: change permissions Signed-off-by: blam --- .github/workflows/goalie.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/goalie.yaml b/.github/workflows/goalie.yaml index c36122f427..4de64eb6bf 100644 --- a/.github/workflows/goalie.yaml +++ b/.github/workflows/goalie.yaml @@ -10,7 +10,7 @@ on: permissions: issues: write - pull-requests: read + pull-requests: write jobs: label: From b0755576c22808557481ba662df3865985c6b7d8 Mon Sep 17 00:00:00 2001 From: blam Date: Tue, 18 Jan 2022 15:16:42 +0100 Subject: [PATCH 9/9] chore: pretty Signed-off-by: blam --- .github/workflows/goalie.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/goalie.yaml b/.github/workflows/goalie.yaml index 4de64eb6bf..baa230cdf0 100644 --- a/.github/workflows/goalie.yaml +++ b/.github/workflows/goalie.yaml @@ -8,7 +8,7 @@ on: pull_request: types: [opened, reopened, synchronize] -permissions: +permissions: issues: write pull-requests: write