GA：使用GitHub App生成的临时访问令牌代替fine-grained PAT

详见: #74
maboloshi · Feb 9, 2024 · 9ca226c · 9ca226c
1 parent d191935
commit 9ca226c
Show file tree

Hide file tree

Showing 3 changed files with 30 additions and 6 deletions.
diff --git a/.github/workflows/locals(greasyfork).js_update.yaml b/.github/workflows/locals(greasyfork).js_update.yaml
@@ -7,7 +7,15 @@ on:
 jobs:
   update_version:
     runs-on: ubuntu-latest
+    environment: github-pages
     steps:
+      - name: Generate a token
+        id: generate_token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ vars.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
@@ -36,10 +44,10 @@ jobs:
                 env.MAIN_USER_JS_IS_CHANGED == 'true' }}
         run: |
           bash script/ci_commit_with_signature.sh \
-          -T "${{ secrets.CI_GITHUB_TOKEN }}" \
+          -T "${{ steps.generate_token.outputs.token }}" \
           -R "${{ github.repository }}" \
           -B "${{ github.ref_name }}" \
           -P "${{ github.sha }}" \
           -F "locals(greasyfork).js, main(greasyfork).user.js" \
           -h "main(greasyfork).user.js Update on $(TZ='Asia/Shanghai' date +'%Y-%m-%d')" \
-          -b "Signed-off-by: 沙漠之子 <7850715+maboloshi@users.noreply.github.com>"
+          -b "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
diff --git a/.github/workflows/main.user.js_version_update.yaml b/.github/workflows/main.user.js_version_update.yaml
@@ -8,7 +8,15 @@ on:
 jobs:
   update_version:
     runs-on: ubuntu-latest
+    environment: github-pages
     steps:
+      - name: Generate a token
+        id: generate_token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ vars.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
@@ -50,10 +58,10 @@ jobs:
                 env.MAIN_USER_JS_IS_CHANGED == 'true' }}
         run: |
           bash script/ci_commit_with_signature.sh \
-          -T "${{ secrets.CI_GITHUB_TOKEN }}" \
+          -T "${{ steps.generate_token.outputs.token }}" \
           -R "${{ github.repository }}" \
           -B "${{ github.ref_name }}" \
           -P "${{ github.sha }}" \
           -F "main.user.js" \
           -h "main.user.js Update to version $(TZ='Asia/Shanghai' date +'%Y-%m-%d')" \
-          -b "Signed-off-by: 沙漠之子 <7850715+maboloshi@users.noreply.github.com>"
+          -b "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
diff --git a/.github/workflows/update_contributors_images.yml b/.github/workflows/update_contributors_images.yml
@@ -5,7 +5,15 @@ on:
 jobs:
   build-deploy:
     runs-on: ubuntu-latest
+    environment: github-pages
     steps:
+      - name: Generate a token
+        id: generate_token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ vars.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
       - name: Checkout repository
         uses: actions/checkout@v4
 
@@ -28,10 +36,10 @@ jobs:
         if: ${{ env.CHANGES_DETECTED == 'true' }}
         run: |
           bash script/ci_commit_with_signature.sh \
-          -T "${{ secrets.CI_GITHUB_TOKEN }}" \
+          -T "${{ steps.generate_token.outputs.token }}" \
           -R "${{ github.repository }}" \
           -B "${{ github.ref_name }}" \
           -P "${{ github.sha }}" \
           -F "README.md" \
           -h "修改文档: 更新\`贡献者列表\`" \
-          -b "Signed-off-by: 沙漠之子 <7850715+maboloshi@users.noreply.github.com>"
+          -b "Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"