From 3133e6c689816add797b254c39b8b4fed9abf5e6 Mon Sep 17 00:00:00 2001 From: Jack Baldry Date: Tue, 7 Feb 2023 15:08:40 +0000 Subject: [PATCH] Use organization ISSUE_COMMANDS_TOKEN with reduced scope (#62446) The GH_BOT_ACCESS_TOKEN has permissions beyond those required for addToProject and other API commands that the issue_commands workflow uses. The new token is set at an organization level so it does not require repository administrators to rotate the token. It also has the minimal classic PAT permissions to facilitate the workflow. It has expiry but that expiry is reported via email to the engineering organization and the IT Helpdesk have permissions to regenerate the token when expiration is imminent. Signed-off-by: Jack Baldry --- .github/workflows/commands.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/commands.yml b/.github/workflows/commands.yml index ac5a03f9d5c..534418d1178 100644 --- a/.github/workflows/commands.yml +++ b/.github/workflows/commands.yml @@ -22,5 +22,5 @@ jobs: uses: ./actions/commands with: metricsWriteAPIKey: ${{secrets.GRAFANA_MISC_STATS_API_KEY}} - token: ${{secrets.GH_BOT_ACCESS_TOKEN}} + token: ${{secrets.ISSUE_COMMANDS_TOKEN}} configPath: commands