From b3bee0e8991b5727a7b7a354717cb1f6ceb5d715 Mon Sep 17 00:00:00 2001 From: John Mertic Date: Wed, 23 Sep 2026 10:18:56 -0400 Subject: [PATCH 1/2] Use GitHub App token for authentication Signed-off-by: John Mertic --- .github/workflows/updatedatafromlfx.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/updatedatafromlfx.yml b/.github/workflows/updatedatafromlfx.yml index 7dac271..da73326 100644 --- a/.github/workflows/updatedatafromlfx.yml +++ b/.github/workflows/updatedatafromlfx.yml @@ -7,6 +7,11 @@ jobs: build: runs-on: ubuntu-latest steps: + - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + id: app-token + with: + client-id: ${{ vars.APP_CLIENT_ID }} + private-key: ${{ secrets.APP_PRIVATE_KEY }} - uses: jmertic/lfx-tac-actions@3cc53bcc460908d9a414290e83e8104357b0d652 # 20260908 with: updateprojects: false @@ -18,4 +23,4 @@ jobs: env: repository: ${{ github.repository }} ref: ${{ github.ref }} - token: ${{ secrets.GITHUB_TOKEN }} + token: ${{ steps.app-token.outputs.token }} From 51348fcba4ec8dc10a107acdc7ca25c3e5aec1b3 Mon Sep 17 00:00:00 2001 From: John Mertic Date: Wed, 23 Sep 2026 10:20:21 -0400 Subject: [PATCH 2/2] Update Dependabot workflow to use GitHub App token Signed-off-by: John Mertic --- .github/workflows/dependabot-automerge.yml | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 68b53a2..04a3b85 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -12,17 +12,23 @@ jobs: dependabot: runs-on: ubuntu-latest if: github.actor == 'dependabot[bot]' - steps: + - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + id: app-token + with: + client-id: ${{ vars.APP_CLIENT_ID }} + private-key: ${{ secrets.APP_PRIVATE_KEY }} - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - + with: + token: ${{ steps.app-token.outputs.token }} + ref: ${{ github.head_ref }} + persist-credentials: false - name: Approve PR run: | gh pr review --approve "${{ github.event.pull_request.number }}" env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - + GH_TOKEN: ${{ steps.app-token.outputs.token }} - name: Enable auto-merge run: | gh pr merge \ @@ -30,4 +36,4 @@ jobs: --auto \ "${{ github.event.pull_request.number }}" env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }}