From 13532b62d3fa5ed38a048a644eb4a2a2ab802e93 Mon Sep 17 00:00:00 2001 From: "Grot (@grafanabot)" <43478413+grafanabot@users.noreply.github.com> Date: Wed, 11 Jan 2023 13:12:07 +0200 Subject: [PATCH] [v9.3.x] Update publishing workflows to use PATs with fine-grained access control (#61268) Update publishing workflows to use PATs with fine-grained access control (#61098) Signed-off-by: Jack Baldry Signed-off-by: Jack Baldry (cherry picked from commit 87ccf10ffe9adf8cf9aee48d27964a6c704ee8ac) Co-authored-by: Jack Baldry --- .../workflows/publish-technical-documentation-next.yml | 8 ++++++-- .../workflows/publish-technical-documentation-release.yml | 8 ++++++-- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/.github/workflows/publish-technical-documentation-next.yml b/.github/workflows/publish-technical-documentation-next.yml index 193993fb4e8..d9f412ecfb2 100644 --- a/.github/workflows/publish-technical-documentation-next.yml +++ b/.github/workflows/publish-technical-documentation-next.yml @@ -16,7 +16,9 @@ jobs: uses: "actions/checkout@v3" - name: "Clone website-sync Action" - run: "git clone --single-branch --no-tags --depth 1 -b master https://grafanabot:${{ secrets.GH_BOT_ACCESS_TOKEN }}@github.com/grafana/website-sync ./.github/actions/website-sync" + # WEBSITE_SYNC_GRAFANA is a fine-grained GitHub Personal Access Token that expires. + # It must be updated in the grafanabot GitHub account. + run: "git clone --single-branch --no-tags --depth 1 -b master https://grafanabot:${{ secrets.WEBSITE_SYNC_GRAFANA }}@github.com/grafana/website-sync ./.github/actions/website-sync" - name: "Publish to website repository (next)" uses: "./.github/actions/website-sync" @@ -25,6 +27,8 @@ jobs: repository: "grafana/website" branch: "master" host: "github.com" - github_pat: "${{ secrets.GH_BOT_ACCESS_TOKEN }}" + # PUBLISH_TO_WEBSITE_GRAFANA is a fine-grained GitHub Personal Access Token that expires. + # It must be updated in the grafanabot GitHub account. + github_pat: "grafanabot:${{ secrets.PUBLISH_TO_WEBSITE_GRAFANA }}" source_folder: "docs/sources" target_folder: "content/docs/grafana/next" diff --git a/.github/workflows/publish-technical-documentation-release.yml b/.github/workflows/publish-technical-documentation-release.yml index dd4a6ae9309..02862430904 100644 --- a/.github/workflows/publish-technical-documentation-release.yml +++ b/.github/workflows/publish-technical-documentation-release.yml @@ -45,7 +45,9 @@ jobs: - name: "Clone website-sync Action" if: "steps.has-matching-release-tag.outputs.bool == 'true'" - run: "git clone --single-branch --no-tags --depth 1 -b master https://grafanabot:${{ secrets.GH_BOT_ACCESS_TOKEN }}@github.com/grafana/website-sync ./.github/actions/website-sync" + # WEBSITE_SYNC_GRAFANA is a fine-grained GitHub Personal Access Token that expires. + # It must be updated in the grafanabot GitHub account. + run: "git clone --single-branch --no-tags --depth 1 -b master https://grafanabot:${{ secrets.WEBSITE_SYNC_GRAFANA }}@github.com/grafana/website-sync ./.github/actions/website-sync" - name: "Publish to website repository (release)" if: "steps.has-matching-release-tag.outputs.bool == 'true'" @@ -55,6 +57,8 @@ jobs: repository: "grafana/website" branch: "master" host: "github.com" - github_pat: "${{ secrets.GH_BOT_ACCESS_TOKEN }}" + # PUBLISH_TO_WEBSITE_GRAFANA is a fine-grained GitHub Personal Access Token that expires. + # It must be updated in the grafanabot GitHub account. + github_pat: "grafanabot:${{ secrets.PUBLISH_TO_WEBSITE_GRAFANA }}" source_folder: "docs/sources" target_folder: "content/docs/grafana/${{ steps.target.outputs.target }}"