security: update GitHub workflows to use ISSUES_BOT_TOKEN instead of GITHUB_TOKEN (#4606)

c4cb0b783a47119a0e8adedc43d1bcb64ffe7544

Wolfsblvt <wolfsblvt@gmail.com>

Signed
Parents: 39fd16fe86230e551449f71d0bd9b5d28a4d4b67
7 files changed, +20 -20Showing whitespace changes
.github/workflows/issues-auto-manager.yml+7 -7
@@ -32,7 +32,7 @@ jobs:
3232 with:
3333 configuration-path: .github/issues-auto-labels.yml
3434 enable-versioned-regex: 0
3535 repo-token: ${{ secrets.GITHUB_TOKENISSUES_BOT_TOKEN }}
3636
3737 label-on-labels:
3838 name: 🏷️ Label Issues by Labels
@@ -46,7 +46,7 @@ jobs:
4646 uses: actions-cool/issues-helper@v3.6.0
4747 with:
4848 actions: 'add-labels'
4949 token: ${{ secrets.GITHUB_TOKENISSUES_BOT_TOKEN }}
5050 labels: '👍 Approved'
5151
5252 - name: ❌ Remove progress labels when issue is marked done or stale
@@ -56,7 +56,7 @@ jobs:
5656 uses: actions-cool/issues-helper@v3.6.0
5757 with:
5858 actions: 'remove-labels'
5959 token: ${{ secrets.GITHUB_TOKENISSUES_BOT_TOKEN }}
6060 labels: '🧑‍💻 In Progress,🤔 Unsure,🤔 Under Consideration'
6161
6262 - name: ❌ Remove temporary labels when confirmed labels are added
@@ -66,7 +66,7 @@ jobs:
6666 uses: actions-cool/issues-helper@v3.6.0
6767 with:
6868 actions: 'remove-labels'
6969 token: ${{ secrets.GITHUB_TOKENISSUES_BOT_TOKEN }}
7070 labels: '🤔 Unsure,🤔 Under Consideration'
7171
7272 - name: ❌ Remove no bug labels when "🪲 Confirmed" is added
@@ -76,7 +76,7 @@ jobs:
7676 uses: actions-cool/issues-helper@v3.6.0
7777 with:
7878 actions: 'remove-labels'
7979 token: ${{ secrets.GITHUB_TOKENISSUES_BOT_TOKEN }}
8080 labels: '✖️ Not Reproducible,✖️ Not A Bug'
8181
8282 remove-stale-label:
@@ -92,7 +92,7 @@ jobs:
9292 uses: actions-cool/issues-helper@v3.6.0
9393 with:
9494 actions: 'remove-labels'
9595 token: ${{ secrets.GITHUB_TOKENISSUES_BOT_TOKEN }}
9696 issue-number: ${{ github.event.issue.number }}
9797 labels: '⚰️ Stale,🕸️ Inactive,🚏 Awaiting User Response,🛑 No Response'
9898
@@ -113,4 +113,4 @@ jobs:
113113 uses: peaceiris/actions-label-commenter@v1.10.0
114114 with:
115115 config_file: .github/issues-auto-comments.yml
116116 github_token: ${{ secrets.GITHUB_TOKENISSUES_BOT_TOKEN }}
.github/workflows/issues-updates-on-merge.yml+1 -1
@@ -31,7 +31,7 @@ jobs:
3131 - name: Label Linked Issues
3232 id: label_linked_issues
3333 env:
3434 GH_TOKEN: ${{ secrets.GITHUB_TOKENISSUES_BOT_TOKEN }}
3535 run: |
3636 for ISSUE in $(echo $issues | jq -r '.[]'); do
3737 if [ "${{ github.ref }}" == "refs/heads/staging" ]; then
.github/workflows/job-close-stale.yml+3 -3
@@ -22,7 +22,7 @@ jobs:
2222 # https://github.com/marketplace/actions/close-stale-issues
2323 uses: actions/stale@v9.1.0
2424 with:
2525 repo-token: ${{ secrets.GITHUB_TOKENISSUES_BOT_TOKEN }}
2626 days-before-stale: 183
2727 days-before-close: 7
2828 operations-per-run: 30
@@ -56,7 +56,7 @@ jobs:
5656 # https://github.com/marketplace/actions/close-stale-issues
5757 uses: actions/stale@v9.1.0
5858 with:
5959 repo-token: ${{ secrets.GITHUB_TOKENISSUES_BOT_TOKEN }}
6060 days-before-stale: 7
6161 days-before-close: 7
6262 operations-per-run: 30
@@ -83,7 +83,7 @@ jobs:
8383 # https://github.com/marketplace/actions/close-stale-issues
8484 uses: actions/stale@v9.1.0
8585 with:
8686 repo-token: ${{ secrets.GITHUB_TOKENISSUES_BOT_TOKEN }}
8787 days-before-stale: 7
8888 days-before-close: 7
8989 operations-per-run: 30
.github/workflows/on-close-handler.yml+1 -1
@@ -23,6 +23,6 @@ jobs:
2323 uses: actions-cool/issues-helper@v3.6.0
2424 with:
2525 actions: remove-labels
2626 token: ${{ secrets.GITHUB_TOKENISSUES_BOT_TOKEN }}
2727 issue-number: ${{ github.event.issue.number || github.event.pull_request.number }}
2828 labels: '🚏 Awaiting User Response,🧑‍💻 In Progress,📌 Keep Open,🚫 Merge Conflicts,🔬 Needs Testing,🔨 Needs Work,⚰️ Stale,⛔ Waiting For External/Upstream'
.github/workflows/on-open-handler.yml+1 -1
@@ -24,6 +24,6 @@ jobs:
2424 uses: actions-cool/issues-helper@v3.6.0
2525 with:
2626 actions: 'add-labels'
2727 token: ${{ secrets.GITHUB_TOKENISSUES_BOT_TOKEN }}
2828 issue-number: ${{ github.event.issue.number || github.event.pull_request.number }}
2929 labels: '👷 Maintainer'
.github/workflows/pr-auto-manager.yml+6 -6
@@ -76,7 +76,7 @@ jobs:
7676 # https://github.com/marketplace/actions/pull-request-size-labeler
7777 uses: codelytv/pr-size-labeler@v1.10.2
7878 with:
7979 GITHUB_TOKEN: ${{ secrets.GITHUB_TOKENISSUES_BOT_TOKEN }}
8080 xs_label: '🟩 ⬤○○○○'
8181 xs_max_size: '20'
8282 s_label: '🟩 ⬤⬤○○○'
@@ -109,7 +109,7 @@ jobs:
109109 uses: actions/labeler@v5.0.0
110110 with:
111111 configuration-path: .github/pr-auto-labels-by-branch.yml
112112 repo-token: ${{ secrets.GITHUB_TOKENISSUES_BOT_TOKEN }}
113113
114114 label-by-files:
115115 name: 🏷️ Label PR by Files
@@ -129,7 +129,7 @@ jobs:
129129 uses: actions/labeler@v5.0.0
130130 with:
131131 configuration-path: .github/pr-auto-labels-by-files.yml
132132 repo-token: ${{ secrets.GITHUB_TOKENISSUES_BOT_TOKEN }}
133133
134134 remove-stale-label:
135135 name: 🗑️ Remove Stale Label on Comment
@@ -150,7 +150,7 @@ jobs:
150150 uses: actions-cool/issues-helper@v3.6.0
151151 with:
152152 actions: 'remove-labels'
153153 token: ${{ secrets.GITHUB_TOKENISSUES_BOT_TOKEN }}
154154 issue-number: ${{ github.event.pull_request.number }}
155155 labels: '⚰️ Stale'
156156
@@ -250,7 +250,7 @@ jobs:
250250 PR_NUMBER=${{ github.event.pull_request.number }}
251251 REPO=${{ github.repository }}
252252 API_URL="https://api.github.com/repos/$REPO/pulls/$PR_NUMBER/issues"
253253 ISSUES=$(curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKENISSUES_BOT_TOKEN }}" "$API_URL" | jq -r '.[].number' | jq -R -s -c 'split("\n")[:-1]')
254254 echo "linked_issues=$ISSUES" >> $GITHUB_ENV
255255
256256 - name: Merge Issue Lists
@@ -262,7 +262,7 @@ jobs:
262262 - name: Label Linked Issues
263263 id: label_linked_issues
264264 env:
265265 GH_TOKEN: ${{ secrets.GITHUB_TOKENISSUES_BOT_TOKEN }}
266266 run: |
267267 for ISSUE in $(echo $final_issues | jq -r '.[]'); do
268268 gh issue edit $ISSUE -R ${{ github.repository }} --add-label "✅ Done (staging)" --remove-label "🧑‍💻 In Progress"
.github/workflows/pr-check-merge-conflicts.yaml+1 -1
@@ -23,6 +23,6 @@ jobs:
2323 uses: eps1lon/actions-label-merge-conflict@v3.0.3
2424 with:
2525 dirtyLabel: '🚫 Merge Conflicts'
2626 repoToken: ${{ secrets.GITHUB_TOKENISSUES_BOT_TOKEN }}
2727 commentOnDirty: >
2828 ⚠️ This PR has conflicts that need to be resolved before it can be merged.