Skip to content

Tweaks to the "Commit Built File Changes" workflow #11808

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
johnbillion wants to merge 5 commits into
base: trunk
Choose a base branch
from
+10 −13
Open

Tweaks to the "Commit Built File Changes" workflow #11808

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
55312b7
No need for this job to have write access to contents.
johnbillion May 12, 2026
9761ddc
No need to do a dance with this value, just read it directly from its…
johnbillion May 12, 2026
ffb5abd
Read this directly from its environment variable too.
johnbillion May 12, 2026
0ea4e1e
Pass the access token to the next step using output instead of settin…
johnbillion May 12, 2026
2c942d5
The app ID is not a secret.
johnbillion May 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 10 additions & 13 deletions .github/workflows/commit-built-file-changes.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,9 @@ jobs:
if: ${{ github.repository == 'wordpress/wordpress-develop' }}
timeout-minutes: 10
permissions:
contents: write
# The actual `git push` is authenticated via a dedicated GitHub App installation token
# generated below, so `GITHUB_TOKEN` only needs read access to the triggering workflow's artifacts.
actions: read # Required to list and download the artifact uploaded by the triggering workflow run.
steps:
- name: Download artifact
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
Expand Down Expand Up @@ -90,21 +92,18 @@ jobs:
id: generate_token
if: ${{ steps.artifact-check.outputs.exists == 'true' }}
env:
GH_APP_ID: ${{ secrets.GH_PR_BUILT_FILES_APP_ID }}
GH_APP_ID: ${{ vars.GH_PR_BUILT_FILES_APP_ID }}
GH_APP_PRIVATE_KEY: ${{ secrets.GH_PR_BUILT_FILES_PRIVATE_KEY }}
run: |
echo "$GH_APP_PRIVATE_KEY" > private-key.pem

# Generate JWT
JWT=$(python3 - <<EOF
import jwt, time
private_key = open("private-key.pem", "r").read()
import jwt, time, os
payload = {
"iat": int(time.time()),
"exp": int(time.time()) + 600, # 10-minute expiration
"iss": $GH_APP_ID
"iss": int(os.environ["GH_APP_ID"]),
}
print(jwt.encode(payload, private_key, algorithm="RS256"))
print(jwt.encode(payload, os.environ["GH_APP_PRIVATE_KEY"], algorithm="RS256"))
EOF
)

Expand All @@ -118,9 +117,7 @@ jobs:
-H "Accept: application/vnd.github.v3+json" \
"https://api.github.com/app/installations/$INSTALLATION_ID/access_tokens" | jq -r '.token')

echo "ACCESS_TOKEN=$ACCESS_TOKEN" >> "$GITHUB_ENV"

rm -f private-key.pem
echo "access-token=$ACCESS_TOKEN" >> "$GITHUB_OUTPUT"

- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
Expand All @@ -130,7 +127,7 @@ jobs:
ref: ${{ github.event.workflow_run.head_branch }}
path: 'pr-repo'
show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
token: ${{ env.ACCESS_TOKEN }}
token: ${{ steps.generate_token.outputs.access-token }}
persist-credentials: true

- name: Apply patch
Expand All @@ -147,7 +144,7 @@ jobs:
if: ${{ steps.artifact-check.outputs.exists == 'true' }}
working-directory: 'pr-repo'
env:
GH_APP_ID: ${{ secrets.GH_PR_BUILT_FILES_APP_ID }}
GH_APP_ID: ${{ vars.GH_PR_BUILT_FILES_APP_ID }}
run: |
git config user.name "wordpress-develop-pr-bot[bot]"
git config user.email "${GH_APP_ID}+wordpress-develop-pr-bot[bot]@users.noreply.github.com"
Expand Down
Loading