[ACS-12108] Introduce signed commits for ACA workflows (#5273)

* [ACS-12108] Introduce signed commits for ACA workflows

* [ACS-12108] CR fixes

* [ACS-12108] CR fix

* [ACS-12108] Migrate PR creation to create-pull-request

* [ACS-12108] Use read-only token

.github/workflows/pull-from-crowdin.yml

@@ -7,8 +7,18 @@ jobs:
   pull-from-crowdin:
     runs-on: ubuntu-latest
     steps:
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.GH_APP_ENGINEERING_CONTRIB_CLIENT_ID }}
+          private-key: ${{ secrets.GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          token: ${{ steps.app-token.outputs.token }}
       - name: Pull translations from Crowdin
         uses: crowdin/github-action@52aa776766211d83d975df51f3b9c53c2f8ba35f # v2.16.3
         with:
@@ -22,5 +32,5 @@ jobs:
           github_user_email: ${{ vars.HXPS_GIT_EMAIL }}
           gpg_private_key: ${{ secrets.HXPS_GIT_COMMIT_SIGNING_PRIVATE_KEY }}
         env:
-          GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
           CROWDIN_TOKEN: ${{ secrets.CROWDIN_TRANSLATIONS_TOKEN }}

.github/workflows/upstream-adf.yml

@@ -10,9 +10,6 @@ on:
         type: string
         default: 'alpha'
 
-env:
-  GH_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
-
 jobs:
   upstream:
     runs-on: ubuntu-latest
@@ -29,11 +26,20 @@ jobs:
         uses: actions/checkout@v7
         with:
           fetch-depth: 1
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.GH_APP_ENGINEERING_RO_CLIENT_ID }}
+          private-key: ${{ secrets.GH_APP_ENGINEERING_RO_PRIVATE_KEY }}
+          permission-contents: read
+          permission-packages: read
+          permission-pull-requests: read
       - id: fetchLatestPkg
         name: Fetch the latest package version
         uses: actions/github-script@v9
         with:
-          github-token: ${{ secrets.BOT_GITHUB_TOKEN }}
+          github-token: ${{ steps.app-token.outputs.token }}
           script: |
             const getLatestVersionOf = require('./scripts/gh/update/latest-version-of.js');
             const { hasNewVersion: hasNewADFVersion , remoteVersion: latestADFVersion } = await getLatestVersionOf({exec, github, dependencyName: 'adf-core', tag: '${{ inputs.tag }}'});
@@ -74,7 +80,7 @@ jobs:
           HAS_NEW_JS_VERSION: ${{ steps.fetchLatestPkg.outputs.hasNewJSVersion }}
           LATEST_JS_VERSION: ${{ steps.fetchLatestPkg.outputs.latestJSVersion }}
         with:
-          github-token: ${{ secrets.BOT_GITHUB_TOKEN }}
+          github-token: ${{ steps.app-token.outputs.token }}
           script: |
             // verify if there is already an Upstream PR pending
             const hasNewADFVersion = process.env.HAS_NEW_ADF_VERSION;
@@ -103,10 +109,17 @@ jobs:
     runs-on: ubuntu-latest
     needs: upstream
     steps:
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.GH_APP_ENGINEERING_CONTRIB_CLIENT_ID }}
+          private-key: ${{ secrets.GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
       - name: Checkout repository
         uses: actions/checkout@v7
         with:
-          token: ${{ secrets.BOT_GITHUB_TOKEN }}
           fetch-depth: 1
       - name: setup NPM
         uses: actions/setup-node@v6
@@ -120,7 +133,6 @@ jobs:
           IS_JS_AFFECTED: ${{ needs.upstream.outputs.hasNewJSVersion }}
           PACKAGE_VERSION_ADF: ${{ needs.upstream.outputs.latestADFVersion }}
           PACKAGE_VERSION_JS: ${{ needs.upstream.outputs.latestJSVersion }}
-          BRANCH_TO_CREATE: "upstream-dependencies"
         run: |
           migrateDependenciesADF() {
               echo "Update ADF dependencies to: ${PACKAGE_VERSION_ADF}"
@@ -137,10 +149,6 @@ jobs:
               ./scripts/update-version.sh -v ${PACKAGE_VERSION_ADF} -vj ${PACKAGE_VERSION_JS}
               echo "Migration done"
           }
-          if git checkout ${BRANCH_TO_CREATE} 2>/dev/null ; then
-            git reset --hard origin/develop
-            echo "Reset branch"
-          fi
           if [[ "$IS_ADF_AFFECTED" == "true" ]] && [[ "$IS_JS_AFFECTED" == "true" ]]; then
             migrateAllDependencies
           elif [[ "$IS_ADF_AFFECTED" == "true" ]]; then
@@ -148,58 +156,31 @@ jobs:
           elif [[ "$IS_JS_AFFECTED" == "true" ]]; then
             migrateDependenciesJS
           fi
-      - name: Commit Code
+      - name: Prepare PR title
-        if: ${{ needs.upstream.outputs.hasNewVersion == 'true'  }}
+        id: pr-meta
-        uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d #v6
+        if: ${{ needs.upstream.outputs.hasNewVersion == 'true' }}
-        with:
-          commit_message: "[ci:force][auto-commit] Update dependencies ADF:${{ needs.upstream.outputs.latestADFVersion }}  JS:${{ needs.upstream.outputs.latestJSVersion }}"
-          branch: upstream-dependencies
-          push_options: '--force'
-          create_branch: true
-
-      - name: Create a Pull request
-        uses: actions/github-script@v9
         env:
           PACKAGE_VERSION_ADF: ${{ needs.upstream.outputs.latestADFVersion }}
           PACKAGE_VERSION_JS: ${{ needs.upstream.outputs.latestJSVersion }}
+        run: |
+          if [[ "$PACKAGE_VERSION_ADF" == "next" || "$PACKAGE_VERSION_ADF" == "latest" ]]; then
+            title="GH Auto: Upstream dependencies ADF and JS-API using Tag:${PACKAGE_VERSION_ADF}"
+          else
+            title="GH Auto: Upstream dependencies ADF:${PACKAGE_VERSION_ADF} JS-API:${PACKAGE_VERSION_JS} using Tag:${PACKAGE_VERSION_ADF}"
+          fi
+          echo "title=$title" >> "$GITHUB_OUTPUT"
+
+      - name: Create a Pull request
+        if: ${{ needs.upstream.outputs.hasNewVersion == 'true' }}
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
-          github-token: ${{ secrets.BOT_GITHUB_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
-          script: |
+          base: develop
-            const { PACKAGE_VERSION_ADF } = process.env;
+          branch: upstream-dependencies
-            const { PACKAGE_VERSION_JS } = process.env;
+          sign-commits: true
-            const BRANCH_TO_CREATE = 'upstream-dependencies';
+          commit-message: "[ci:force][auto-commit] Update dependencies ADF:${{ needs.upstream.outputs.latestADFVersion }}  JS:${{ needs.upstream.outputs.latestJSVersion }}"
-            let title = `GH Auto: Upstream dependencies ADF:${PACKAGE_VERSION_ADF} JS-API:${PACKAGE_VERSION_JS} using Tag:${PACKAGE_VERSION_ADF}`;
+          title: ${{ steps.pr-meta.outputs.title }}
-            if (PACKAGE_VERSION_ADF === 'next' || PACKAGE_VERSION_ADF === 'latest') {
+          body: Automatic PR
-              title = `GH Auto: Upstream dependencies ADF and JS-API using Tag:${PACKAGE_VERSION_ADF}`;
+          add-paths: |
-            }
+            package.json
-            const { data: prs } = await github.rest.pulls.list({
+            package-lock.json
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              state: 'open',
-              head: `${context.repo.owner}:${BRANCH_TO_CREATE}`,
-              base: 'develop'
-            });
-            if (prs.length < 1) {
-                const payloadPullRequest = {
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  title: title,
-                  head: `${context.repo.owner}:${BRANCH_TO_CREATE}`,
-                  base: 'develop',
-                  body: `Automatic PR`
-                };
-                console.log('Payload: ',payloadPullRequest);
-                const { data: pr } = await github.rest.pulls.create(payloadPullRequest);
-                return pr.number;
-            } else {
-                const upstreamPrOpen = prs[0];
-                // override the title to contains the latest adf dep number
-                const payloadUpdatePullRequest = {
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  pull_number: upstreamPrOpen.number,
-                  title: title,
-                };
-                await github.rest.pulls.update(payloadUpdatePullRequest);
-                return upstreamPrOpen.number;
-            }