security: update GitHub workflows to use ISSUES_BOT_TOKEN instead of GITHUB_TOKEN (#4606)

c4cb0b783a47119a0e8adedc43d1bcb64ffe7544

Wolfsblvt <wolfsblvt@gmail.com>

Signed
Parents: 39fd16fe86230e551449f71d0bd9b5d28a4d4b67
7 files changed, +20 -20Showing whitespace changes
.github/workflows/issues-auto-manager.yml+7 -7
@@ -32,7 +32,7 @@ jobs:
32 with:32 with:
33 configuration-path: .github/issues-auto-labels.yml33 configuration-path: .github/issues-auto-labels.yml
34 enable-versioned-regex: 034 enable-versioned-regex: 0
35 repo-token: ${{ secrets.GITHUB_TOKEN }}35 repo-token: ${{ secrets.ISSUES_BOT_TOKEN }}
3636
37 label-on-labels:37 label-on-labels:
38 name: 🏷️ Label Issues by Labels38 name: 🏷️ Label Issues by Labels
@@ -46,7 +46,7 @@ jobs:
46 uses: actions-cool/issues-helper@v3.6.046 uses: actions-cool/issues-helper@v3.6.0
47 with:47 with:
48 actions: 'add-labels'48 actions: 'add-labels'
49 token: ${{ secrets.GITHUB_TOKEN }}49 token: ${{ secrets.ISSUES_BOT_TOKEN }}
50 labels: '👍 Approved'50 labels: '👍 Approved'
5151
52 - name: ❌ Remove progress labels when issue is marked done or stale52 - name: ❌ Remove progress labels when issue is marked done or stale
@@ -56,7 +56,7 @@ jobs:
56 uses: actions-cool/issues-helper@v3.6.056 uses: actions-cool/issues-helper@v3.6.0
57 with:57 with:
58 actions: 'remove-labels'58 actions: 'remove-labels'
59 token: ${{ secrets.GITHUB_TOKEN }}59 token: ${{ secrets.ISSUES_BOT_TOKEN }}
60 labels: '🧑‍💻 In Progress,🤔 Unsure,🤔 Under Consideration'60 labels: '🧑‍💻 In Progress,🤔 Unsure,🤔 Under Consideration'
6161
62 - name: ❌ Remove temporary labels when confirmed labels are added62 - name: ❌ Remove temporary labels when confirmed labels are added
@@ -66,7 +66,7 @@ jobs:
66 uses: actions-cool/issues-helper@v3.6.066 uses: actions-cool/issues-helper@v3.6.0
67 with:67 with:
68 actions: 'remove-labels'68 actions: 'remove-labels'
69 token: ${{ secrets.GITHUB_TOKEN }}69 token: ${{ secrets.ISSUES_BOT_TOKEN }}
70 labels: '🤔 Unsure,🤔 Under Consideration'70 labels: '🤔 Unsure,🤔 Under Consideration'
7171
72 - name: ❌ Remove no bug labels when "🪲 Confirmed" is added72 - name: ❌ Remove no bug labels when "🪲 Confirmed" is added
@@ -76,7 +76,7 @@ jobs:
76 uses: actions-cool/issues-helper@v3.6.076 uses: actions-cool/issues-helper@v3.6.0
77 with:77 with:
78 actions: 'remove-labels'78 actions: 'remove-labels'
79 token: ${{ secrets.GITHUB_TOKEN }}79 token: ${{ secrets.ISSUES_BOT_TOKEN }}
80 labels: '✖️ Not Reproducible,✖️ Not A Bug'80 labels: '✖️ Not Reproducible,✖️ Not A Bug'
8181
82 remove-stale-label:82 remove-stale-label:
@@ -92,7 +92,7 @@ jobs:
92 uses: actions-cool/issues-helper@v3.6.092 uses: actions-cool/issues-helper@v3.6.0
93 with:93 with:
94 actions: 'remove-labels'94 actions: 'remove-labels'
95 token: ${{ secrets.GITHUB_TOKEN }}95 token: ${{ secrets.ISSUES_BOT_TOKEN }}
96 issue-number: ${{ github.event.issue.number }}96 issue-number: ${{ github.event.issue.number }}
97 labels: '⚰️ Stale,🕸️ Inactive,🚏 Awaiting User Response,🛑 No Response'97 labels: '⚰️ Stale,🕸️ Inactive,🚏 Awaiting User Response,🛑 No Response'
9898
@@ -113,4 +113,4 @@ jobs:
113 uses: peaceiris/actions-label-commenter@v1.10.0113 uses: peaceiris/actions-label-commenter@v1.10.0
114 with:114 with:
115 config_file: .github/issues-auto-comments.yml115 config_file: .github/issues-auto-comments.yml
116 github_token: ${{ secrets.GITHUB_TOKEN }}116 github_token: ${{ secrets.ISSUES_BOT_TOKEN }}
.github/workflows/issues-updates-on-merge.yml+1 -1
@@ -31,7 +31,7 @@ jobs:
31 - name: Label Linked Issues31 - name: Label Linked Issues
32 id: label_linked_issues32 id: label_linked_issues
33 env:33 env:
34 GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}34 GH_TOKEN: ${{ secrets.ISSUES_BOT_TOKEN }}
35 run: |35 run: |
36 for ISSUE in $(echo $issues | jq -r '.[]'); do36 for ISSUE in $(echo $issues | jq -r '.[]'); do
37 if [ "${{ github.ref }}" == "refs/heads/staging" ]; then37 if [ "${{ github.ref }}" == "refs/heads/staging" ]; then
.github/workflows/job-close-stale.yml+3 -3
@@ -22,7 +22,7 @@ jobs:
22 # https://github.com/marketplace/actions/close-stale-issues22 # https://github.com/marketplace/actions/close-stale-issues
23 uses: actions/stale@v9.1.023 uses: actions/stale@v9.1.0
24 with:24 with:
25 repo-token: ${{ secrets.GITHUB_TOKEN }}25 repo-token: ${{ secrets.ISSUES_BOT_TOKEN }}
26 days-before-stale: 18326 days-before-stale: 183
27 days-before-close: 727 days-before-close: 7
28 operations-per-run: 3028 operations-per-run: 30
@@ -56,7 +56,7 @@ jobs:
56 # https://github.com/marketplace/actions/close-stale-issues56 # https://github.com/marketplace/actions/close-stale-issues
57 uses: actions/stale@v9.1.057 uses: actions/stale@v9.1.0
58 with:58 with:
59 repo-token: ${{ secrets.GITHUB_TOKEN }}59 repo-token: ${{ secrets.ISSUES_BOT_TOKEN }}
60 days-before-stale: 760 days-before-stale: 7
61 days-before-close: 761 days-before-close: 7
62 operations-per-run: 3062 operations-per-run: 30
@@ -83,7 +83,7 @@ jobs:
83 # https://github.com/marketplace/actions/close-stale-issues83 # https://github.com/marketplace/actions/close-stale-issues
84 uses: actions/stale@v9.1.084 uses: actions/stale@v9.1.0
85 with:85 with:
86 repo-token: ${{ secrets.GITHUB_TOKEN }}86 repo-token: ${{ secrets.ISSUES_BOT_TOKEN }}
87 days-before-stale: 787 days-before-stale: 7
88 days-before-close: 788 days-before-close: 7
89 operations-per-run: 3089 operations-per-run: 30
.github/workflows/on-close-handler.yml+1 -1
@@ -23,6 +23,6 @@ jobs:
23 uses: actions-cool/issues-helper@v3.6.023 uses: actions-cool/issues-helper@v3.6.0
24 with:24 with:
25 actions: remove-labels25 actions: remove-labels
26 token: ${{ secrets.GITHUB_TOKEN }}26 token: ${{ secrets.ISSUES_BOT_TOKEN }}
27 issue-number: ${{ github.event.issue.number || github.event.pull_request.number }}27 issue-number: ${{ github.event.issue.number || github.event.pull_request.number }}
28 labels: '🚏 Awaiting User Response,🧑‍💻 In Progress,📌 Keep Open,🚫 Merge Conflicts,🔬 Needs Testing,🔨 Needs Work,⚰️ Stale,⛔ Waiting For External/Upstream'28 labels: '🚏 Awaiting User Response,🧑‍💻 In Progress,📌 Keep Open,🚫 Merge Conflicts,🔬 Needs Testing,🔨 Needs Work,⚰️ Stale,⛔ Waiting For External/Upstream'
.github/workflows/on-open-handler.yml+1 -1
@@ -24,6 +24,6 @@ jobs:
24 uses: actions-cool/issues-helper@v3.6.024 uses: actions-cool/issues-helper@v3.6.0
25 with:25 with:
26 actions: 'add-labels'26 actions: 'add-labels'
27 token: ${{ secrets.GITHUB_TOKEN }}27 token: ${{ secrets.ISSUES_BOT_TOKEN }}
28 issue-number: ${{ github.event.issue.number || github.event.pull_request.number }}28 issue-number: ${{ github.event.issue.number || github.event.pull_request.number }}
29 labels: '👷 Maintainer'29 labels: '👷 Maintainer'
.github/workflows/pr-auto-manager.yml+6 -6
@@ -76,7 +76,7 @@ jobs:
76 # https://github.com/marketplace/actions/pull-request-size-labeler76 # https://github.com/marketplace/actions/pull-request-size-labeler
77 uses: codelytv/pr-size-labeler@v1.10.277 uses: codelytv/pr-size-labeler@v1.10.2
78 with:78 with:
79 GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}79 GITHUB_TOKEN: ${{ secrets.ISSUES_BOT_TOKEN }}
80 xs_label: '🟩 ⬤○○○○'80 xs_label: '🟩 ⬤○○○○'
81 xs_max_size: '20'81 xs_max_size: '20'
82 s_label: '🟩 ⬤⬤○○○'82 s_label: '🟩 ⬤⬤○○○'
@@ -109,7 +109,7 @@ jobs:
109 uses: actions/labeler@v5.0.0109 uses: actions/labeler@v5.0.0
110 with:110 with:
111 configuration-path: .github/pr-auto-labels-by-branch.yml111 configuration-path: .github/pr-auto-labels-by-branch.yml
112 repo-token: ${{ secrets.GITHUB_TOKEN }}112 repo-token: ${{ secrets.ISSUES_BOT_TOKEN }}
113113
114 label-by-files:114 label-by-files:
115 name: 🏷️ Label PR by Files115 name: 🏷️ Label PR by Files
@@ -129,7 +129,7 @@ jobs:
129 uses: actions/labeler@v5.0.0129 uses: actions/labeler@v5.0.0
130 with:130 with:
131 configuration-path: .github/pr-auto-labels-by-files.yml131 configuration-path: .github/pr-auto-labels-by-files.yml
132 repo-token: ${{ secrets.GITHUB_TOKEN }}132 repo-token: ${{ secrets.ISSUES_BOT_TOKEN }}
133133
134 remove-stale-label:134 remove-stale-label:
135 name: 🗑️ Remove Stale Label on Comment135 name: 🗑️ Remove Stale Label on Comment
@@ -150,7 +150,7 @@ jobs:
150 uses: actions-cool/issues-helper@v3.6.0150 uses: actions-cool/issues-helper@v3.6.0
151 with:151 with:
152 actions: 'remove-labels'152 actions: 'remove-labels'
153 token: ${{ secrets.GITHUB_TOKEN }}153 token: ${{ secrets.ISSUES_BOT_TOKEN }}
154 issue-number: ${{ github.event.pull_request.number }}154 issue-number: ${{ github.event.pull_request.number }}
155 labels: '⚰️ Stale'155 labels: '⚰️ Stale'
156156
@@ -250,7 +250,7 @@ jobs:
250 PR_NUMBER=${{ github.event.pull_request.number }}250 PR_NUMBER=${{ github.event.pull_request.number }}
251 REPO=${{ github.repository }}251 REPO=${{ github.repository }}
252 API_URL="https://api.github.com/repos/$REPO/pulls/$PR_NUMBER/issues"252 API_URL="https://api.github.com/repos/$REPO/pulls/$PR_NUMBER/issues"
253 ISSUES=$(curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" "$API_URL" | jq -r '.[].number' | jq -R -s -c 'split("\n")[:-1]')253 ISSUES=$(curl -s -H "Authorization: token ${{ secrets.ISSUES_BOT_TOKEN }}" "$API_URL" | jq -r '.[].number' | jq -R -s -c 'split("\n")[:-1]')
254 echo "linked_issues=$ISSUES" >> $GITHUB_ENV254 echo "linked_issues=$ISSUES" >> $GITHUB_ENV
255255
256 - name: Merge Issue Lists256 - name: Merge Issue Lists
@@ -262,7 +262,7 @@ jobs:
262 - name: Label Linked Issues262 - name: Label Linked Issues
263 id: label_linked_issues263 id: label_linked_issues
264 env:264 env:
265 GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}265 GH_TOKEN: ${{ secrets.ISSUES_BOT_TOKEN }}
266 run: |266 run: |
267 for ISSUE in $(echo $final_issues | jq -r '.[]'); do267 for ISSUE in $(echo $final_issues | jq -r '.[]'); do
268 gh issue edit $ISSUE -R ${{ github.repository }} --add-label "✅ Done (staging)" --remove-label "🧑‍💻 In Progress"268 gh issue edit $ISSUE -R ${{ github.repository }} --add-label "✅ Done (staging)" --remove-label "🧑‍💻 In Progress"
.github/workflows/pr-check-merge-conflicts.yaml+1 -1
@@ -23,6 +23,6 @@ jobs:
23 uses: eps1lon/actions-label-merge-conflict@v3.0.323 uses: eps1lon/actions-label-merge-conflict@v3.0.3
24 with:24 with:
25 dirtyLabel: '🚫 Merge Conflicts'25 dirtyLabel: '🚫 Merge Conflicts'
26 repoToken: ${{ secrets.GITHUB_TOKEN }}26 repoToken: ${{ secrets.ISSUES_BOT_TOKEN }}
27 commentOnDirty: >27 commentOnDirty: >
28 ⚠️ This PR has conflicts that need to be resolved before it can be merged.28 ⚠️ This PR has conflicts that need to be resolved before it can be merged.