[ACS-12108] Introduce signed commits for ACA workflows (#5273)

* [ACS-12108] Introduce signed commits for ACA workflows * [ACS-12108] CR fixes * [ACS-12108] CR fix * [ACS-12108] Migrate PR creation to create-pull-request * [ACS-12108] Use read-only token
2026-09-09 18:02:54 +00:00 · 2026-07-10 13:29:04 +02:00
parent c53bf094f1
commit 357c61bf3c
2 changed files with 54 additions and 63 deletions
@@ -7,8 +7,18 @@ jobs:
  pull-from-crowdin:
    runs-on: ubuntu-latest
    steps:
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.GH_APP_ENGINEERING_CONTRIB_CLIENT_ID }}
+          private-key: ${{ secrets.GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
      - name: Checkout
        uses: actions/checkout@v7
+        with:
+          token: ${{ steps.app-token.outputs.token }}
      - name: Pull translations from Crowdin
        uses: crowdin/github-action@52aa776766211d83d975df51f3b9c53c2f8ba35f # v2.16.3
        with:
@@ -22,5 +32,5 @@ jobs:
          github_user_email: ${{ vars.HXPS_GIT_EMAIL }}
          gpg_private_key: ${{ secrets.HXPS_GIT_COMMIT_SIGNING_PRIVATE_KEY }}
        env:
-          GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
          CROWDIN_TOKEN: ${{ secrets.CROWDIN_TRANSLATIONS_TOKEN }}
@@ -10,9 +10,6 @@ on:
        type: string
        default: 'alpha'

-env:
-  GH_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
-
 jobs:
  upstream:
    runs-on: ubuntu-latest
@@ -29,11 +26,20 @@ jobs:
        uses: actions/checkout@v7
        with:
          fetch-depth: 1
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.GH_APP_ENGINEERING_RO_CLIENT_ID }}
+          private-key: ${{ secrets.GH_APP_ENGINEERING_RO_PRIVATE_KEY }}
+          permission-contents: read
+          permission-packages: read
+          permission-pull-requests: read
      - id: fetchLatestPkg
        name: Fetch the latest package version
        uses: actions/github-script@v9
        with:
-          github-token: ${{ secrets.BOT_GITHUB_TOKEN }}
+          github-token: ${{ steps.app-token.outputs.token }}
          script: |
            const getLatestVersionOf = require('./scripts/gh/update/latest-version-of.js');
            const { hasNewVersion: hasNewADFVersion , remoteVersion: latestADFVersion } = await getLatestVersionOf({exec, github, dependencyName: 'adf-core', tag: '${{ inputs.tag }}'});
@@ -74,7 +80,7 @@ jobs:
          HAS_NEW_JS_VERSION: ${{ steps.fetchLatestPkg.outputs.hasNewJSVersion }}
          LATEST_JS_VERSION: ${{ steps.fetchLatestPkg.outputs.latestJSVersion }}
        with:
-          github-token: ${{ secrets.BOT_GITHUB_TOKEN }}
+          github-token: ${{ steps.app-token.outputs.token }}
          script: |
            // verify if there is already an Upstream PR pending
            const hasNewADFVersion = process.env.HAS_NEW_ADF_VERSION;
@@ -103,10 +109,17 @@ jobs:
    runs-on: ubuntu-latest
    needs: upstream
    steps:
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.GH_APP_ENGINEERING_CONTRIB_CLIENT_ID }}
+          private-key: ${{ secrets.GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
-          token: ${{ secrets.BOT_GITHUB_TOKEN }}
          fetch-depth: 1
      - name: setup NPM
        uses: actions/setup-node@v6
@@ -120,7 +133,6 @@ jobs:
          IS_JS_AFFECTED: ${{ needs.upstream.outputs.hasNewJSVersion }}
          PACKAGE_VERSION_ADF: ${{ needs.upstream.outputs.latestADFVersion }}
          PACKAGE_VERSION_JS: ${{ needs.upstream.outputs.latestJSVersion }}
-          BRANCH_TO_CREATE: "upstream-dependencies"
        run: |
          migrateDependenciesADF() {
              echo "Update ADF dependencies to: ${PACKAGE_VERSION_ADF}"
@@ -137,10 +149,6 @@ jobs:
              ./scripts/update-version.sh -v ${PACKAGE_VERSION_ADF} -vj ${PACKAGE_VERSION_JS}
              echo "Migration done"
          }
-          if git checkout ${BRANCH_TO_CREATE} 2>/dev/null ; then
-            git reset --hard origin/develop
-            echo "Reset branch"
-          fi
          if [[ "$IS_ADF_AFFECTED" == "true" ]] && [[ "$IS_JS_AFFECTED" == "true" ]]; then
            migrateAllDependencies
          elif [[ "$IS_ADF_AFFECTED" == "true" ]]; then
@@ -148,58 +156,31 @@ jobs:
          elif [[ "$IS_JS_AFFECTED" == "true" ]]; then
            migrateDependenciesJS
          fi
-      - name: Commit Code
-        if: ${{ needs.upstream.outputs.hasNewVersion == 'true'  }}
-        uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d #v6
-        with:
-          commit_message: "[ci:force][auto-commit] Update dependencies ADF:${{ needs.upstream.outputs.latestADFVersion }}  JS:${{ needs.upstream.outputs.latestJSVersion }}"
-          branch: upstream-dependencies
-          push_options: '--force'
-          create_branch: true
-
-      - name: Create a Pull request
-        uses: actions/github-script@v9
+      - name: Prepare PR title
+        id: pr-meta
+        if: ${{ needs.upstream.outputs.hasNewVersion == 'true' }}
        env:
          PACKAGE_VERSION_ADF: ${{ needs.upstream.outputs.latestADFVersion }}
          PACKAGE_VERSION_JS: ${{ needs.upstream.outputs.latestJSVersion }}
+        run: |
+          if [[ "$PACKAGE_VERSION_ADF" == "next" || "$PACKAGE_VERSION_ADF" == "latest" ]]; then
+            title="GH Auto: Upstream dependencies ADF and JS-API using Tag:${PACKAGE_VERSION_ADF}"
+          else
+            title="GH Auto: Upstream dependencies ADF:${PACKAGE_VERSION_ADF} JS-API:${PACKAGE_VERSION_JS} using Tag:${PACKAGE_VERSION_ADF}"
+          fi
+          echo "title=$title" >> "$GITHUB_OUTPUT"
+
+      - name: Create a Pull request
+        if: ${{ needs.upstream.outputs.hasNewVersion == 'true' }}
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
-          github-token: ${{ secrets.BOT_GITHUB_TOKEN }}
-          script: |
-            const { PACKAGE_VERSION_ADF } = process.env;
-            const { PACKAGE_VERSION_JS } = process.env;
-            const BRANCH_TO_CREATE = 'upstream-dependencies';
-            let title = `GH Auto: Upstream dependencies ADF:${PACKAGE_VERSION_ADF} JS-API:${PACKAGE_VERSION_JS} using Tag:${PACKAGE_VERSION_ADF}`;
-            if (PACKAGE_VERSION_ADF === 'next' || PACKAGE_VERSION_ADF === 'latest') {
-              title = `GH Auto: Upstream dependencies ADF and JS-API using Tag:${PACKAGE_VERSION_ADF}`;
-            }
-            const { data: prs } = await github.rest.pulls.list({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              state: 'open',
-              head: `${context.repo.owner}:${BRANCH_TO_CREATE}`,
-              base: 'develop'
-            });
-            if (prs.length < 1) {
-                const payloadPullRequest = {
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  title: title,
-                  head: `${context.repo.owner}:${BRANCH_TO_CREATE}`,
-                  base: 'develop',
-                  body: `Automatic PR`
-                };
-                console.log('Payload: ',payloadPullRequest);
-                const { data: pr } = await github.rest.pulls.create(payloadPullRequest);
-                return pr.number;
-            } else {
-                const upstreamPrOpen = prs[0];
-                // override the title to contains the latest adf dep number
-                const payloadUpdatePullRequest = {
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  pull_number: upstreamPrOpen.number,
-                  title: title,
-                };
-                await github.rest.pulls.update(payloadUpdatePullRequest);
-                return upstreamPrOpen.number;
-            }
+          token: ${{ steps.app-token.outputs.token }}
+          base: develop
+          branch: upstream-dependencies
+          sign-commits: true
+          commit-message: "[ci:force][auto-commit] Update dependencies ADF:${{ needs.upstream.outputs.latestADFVersion }}  JS:${{ needs.upstream.outputs.latestJSVersion }}"
+          title: ${{ steps.pr-meta.outputs.title }}
+          body: Automatic PR
+          add-paths: |
+            package.json
+            package-lock.json