From 10ae4bfe1e68ff43bf57ed623468e6951c680bd5 Mon Sep 17 00:00:00 2001 From: Hampus Date: Mon, 17 Aug 2026 12:59:29 +0200 Subject: [PATCH] ci: publish releases with the Fluxer CI app instead of the Actions token (#1695) --- .github/workflows/_build-image.yaml | 22 +++++++++++++++++-- .github/workflows/build-admin.yaml | 1 + .github/workflows/build-api.yaml | 1 + .../build-app-proxy-self-hosted.yaml | 1 + .github/workflows/build-app-proxy.yaml | 11 +++++++++- .github/workflows/build-desktop.yaml | 22 +++++++++++++++++-- .github/workflows/build-docs.yaml | 1 + .github/workflows/build-gateway.yaml | 1 + .github/workflows/build-gifs.yaml | 1 + .github/workflows/build-media-proxy.yaml | 1 + .github/workflows/build-messages.yaml | 1 + .github/workflows/build-snowflakes.yaml | 1 + .github/workflows/build-static.yaml | 1 + .github/workflows/build-unfurl.yaml | 1 + .github/workflows/build-users.yaml | 1 + .../dispatch-private-marketing-build.yaml | 11 +++++++++- 16 files changed, 72 insertions(+), 6 deletions(-) diff --git a/.github/workflows/_build-image.yaml b/.github/workflows/_build-image.yaml index a3a4b2da1..19acb8b37 100644 --- a/.github/workflows/_build-image.yaml +++ b/.github/workflows/_build-image.yaml @@ -65,10 +65,19 @@ jobs: uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 with: toolchain: "1.93.0" + - name: Create token + id: create-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 + with: + client-id: ${{ vars.FLUXER_CI_APP_ID }} + private-key: ${{ secrets.FLUXER_CI_APP_KEY }} + owner: fluxerapp + repositories: fluxer + permission-contents: read - name: set variables id: vars env: - GH_TOKEN: ${{ github.token }} + GH_TOKEN: ${{ steps.create-token.outputs.token }} FLUXER_BUILD_VERSION: ${{ inputs['build-version'] }} run: >- cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- resolve-calver @@ -151,9 +160,18 @@ jobs: "${IMAGE}:${VERSION}-arm64" docker buildx imagetools inspect "${IMAGE}:${VERSION}" + - name: Create token + id: create-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 + with: + client-id: ${{ vars.FLUXER_CI_APP_ID }} + private-key: ${{ secrets.FLUXER_CI_APP_KEY }} + owner: fluxerapp + repositories: fluxer + permission-contents: write - name: Publish GitHub release env: - GH_TOKEN: ${{ github.token }} + GH_TOKEN: ${{ steps.create-token.outputs.token }} SOURCE_SHA: ${{ github.sha }} VERSION: ${{ needs.meta.outputs.build_version }} RELEASE_BASELINE_SHA: ${{ vars.RELEASE_BASELINE_SHA }} diff --git a/.github/workflows/build-admin.yaml b/.github/workflows/build-admin.yaml index 30d8b9872..4be6cce30 100644 --- a/.github/workflows/build-admin.yaml +++ b/.github/workflows/build-admin.yaml @@ -29,6 +29,7 @@ jobs: image: needs: approve uses: ./.github/workflows/_build-image.yaml + secrets: inherit with: image: fluxer-admin dockerfile: fluxer_admin/Dockerfile diff --git a/.github/workflows/build-api.yaml b/.github/workflows/build-api.yaml index 195504d84..159518c45 100644 --- a/.github/workflows/build-api.yaml +++ b/.github/workflows/build-api.yaml @@ -29,6 +29,7 @@ jobs: image: needs: approve uses: ./.github/workflows/_build-image.yaml + secrets: inherit with: image: fluxer-api dockerfile: fluxer_api/Dockerfile diff --git a/.github/workflows/build-app-proxy-self-hosted.yaml b/.github/workflows/build-app-proxy-self-hosted.yaml index 37596e4b1..30b395130 100644 --- a/.github/workflows/build-app-proxy-self-hosted.yaml +++ b/.github/workflows/build-app-proxy-self-hosted.yaml @@ -29,6 +29,7 @@ jobs: build: needs: approve uses: ./.github/workflows/_build-image.yaml + secrets: inherit with: image: fluxer-app-proxy-self-hosted dockerfile: fluxer_app_proxy/Dockerfile diff --git a/.github/workflows/build-app-proxy.yaml b/.github/workflows/build-app-proxy.yaml index daf111736..158a75f2d 100644 --- a/.github/workflows/build-app-proxy.yaml +++ b/.github/workflows/build-app-proxy.yaml @@ -187,9 +187,18 @@ jobs: "${IMAGE}:${VERSION}-arm64" docker buildx imagetools inspect "${IMAGE}:${VERSION}" + - name: Create token + id: create-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 + with: + client-id: ${{ vars.FLUXER_CI_APP_ID }} + private-key: ${{ secrets.FLUXER_CI_APP_KEY }} + owner: fluxerapp + repositories: fluxer + permission-contents: write - name: Publish GitHub release env: - GH_TOKEN: ${{ github.token }} + GH_TOKEN: ${{ steps.create-token.outputs.token }} SOURCE_SHA: ${{ github.sha }} VERSION: ${{ needs.meta.outputs.build_version }} RELEASE_BASELINE_SHA: ${{ vars.RELEASE_BASELINE_SHA }} diff --git a/.github/workflows/build-desktop.yaml b/.github/workflows/build-desktop.yaml index 6e749da4a..d86ce7798 100644 --- a/.github/workflows/build-desktop.yaml +++ b/.github/workflows/build-desktop.yaml @@ -67,10 +67,19 @@ jobs: with: toolchain: "1.93.0" + - name: Create token + id: create-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 + with: + client-id: ${{ vars.FLUXER_CI_APP_ID }} + private-key: ${{ secrets.FLUXER_CI_APP_KEY }} + owner: fluxerapp + repositories: fluxer + permission-contents: read - name: Set metadata id: meta env: - GH_TOKEN: ${{ github.token }} + GH_TOKEN: ${{ steps.create-token.outputs.token }} FLUXER_BUILD_VERSION: ${{ inputs.build_version }} run: >- cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop @@ -581,9 +590,18 @@ jobs: uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 with: toolchain: "1.93.0" + - name: Create token + id: create-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 + with: + client-id: ${{ vars.FLUXER_CI_APP_ID }} + private-key: ${{ secrets.FLUXER_CI_APP_KEY }} + owner: fluxerapp + repositories: fluxer + permission-contents: write - name: Publish GitHub desktop release env: - GH_TOKEN: ${{ github.token }} + GH_TOKEN: ${{ steps.create-token.outputs.token }} CHANNEL: ${{ needs.meta.outputs.build_channel }} VERSION: ${{ needs.meta.outputs.version }} SOURCE_SHA: ${{ needs.meta.outputs.source_sha }} diff --git a/.github/workflows/build-docs.yaml b/.github/workflows/build-docs.yaml index a880480f3..19a9255e4 100644 --- a/.github/workflows/build-docs.yaml +++ b/.github/workflows/build-docs.yaml @@ -29,6 +29,7 @@ jobs: image: needs: approve uses: ./.github/workflows/_build-image.yaml + secrets: inherit with: image: fluxer-docs dockerfile: fluxer_docs/Dockerfile diff --git a/.github/workflows/build-gateway.yaml b/.github/workflows/build-gateway.yaml index 698dd4a95..d9485b483 100644 --- a/.github/workflows/build-gateway.yaml +++ b/.github/workflows/build-gateway.yaml @@ -29,6 +29,7 @@ jobs: image: needs: approve uses: ./.github/workflows/_build-image.yaml + secrets: inherit with: image: fluxer-gateway dockerfile: fluxer_gateway/Dockerfile diff --git a/.github/workflows/build-gifs.yaml b/.github/workflows/build-gifs.yaml index abffb51e0..5fb6a8854 100644 --- a/.github/workflows/build-gifs.yaml +++ b/.github/workflows/build-gifs.yaml @@ -29,6 +29,7 @@ jobs: image: needs: approve uses: ./.github/workflows/_build-image.yaml + secrets: inherit with: image: fluxer-gifs dockerfile: fluxer_gifs/Dockerfile diff --git a/.github/workflows/build-media-proxy.yaml b/.github/workflows/build-media-proxy.yaml index b5aada8a6..8c595e679 100644 --- a/.github/workflows/build-media-proxy.yaml +++ b/.github/workflows/build-media-proxy.yaml @@ -29,6 +29,7 @@ jobs: image: needs: approve uses: ./.github/workflows/_build-image.yaml + secrets: inherit with: image: fluxer-media-proxy dockerfile: fluxer_media_proxy/Dockerfile diff --git a/.github/workflows/build-messages.yaml b/.github/workflows/build-messages.yaml index d70265669..2aef5b554 100644 --- a/.github/workflows/build-messages.yaml +++ b/.github/workflows/build-messages.yaml @@ -29,6 +29,7 @@ jobs: image: needs: approve uses: ./.github/workflows/_build-image.yaml + secrets: inherit with: image: fluxer-messages dockerfile: fluxer_messages/Dockerfile diff --git a/.github/workflows/build-snowflakes.yaml b/.github/workflows/build-snowflakes.yaml index 2cd601e7a..e5db27e4a 100644 --- a/.github/workflows/build-snowflakes.yaml +++ b/.github/workflows/build-snowflakes.yaml @@ -29,6 +29,7 @@ jobs: image: needs: approve uses: ./.github/workflows/_build-image.yaml + secrets: inherit with: image: fluxer-snowflakes dockerfile: fluxer_snowflakes/Dockerfile diff --git a/.github/workflows/build-static.yaml b/.github/workflows/build-static.yaml index ed9c997ab..60c5f841d 100644 --- a/.github/workflows/build-static.yaml +++ b/.github/workflows/build-static.yaml @@ -29,6 +29,7 @@ jobs: image: needs: approve uses: ./.github/workflows/_build-image.yaml + secrets: inherit with: image: fluxer-static dockerfile: fluxer_static/Dockerfile diff --git a/.github/workflows/build-unfurl.yaml b/.github/workflows/build-unfurl.yaml index 67a473e3b..4633786ee 100644 --- a/.github/workflows/build-unfurl.yaml +++ b/.github/workflows/build-unfurl.yaml @@ -29,6 +29,7 @@ jobs: image: needs: approve uses: ./.github/workflows/_build-image.yaml + secrets: inherit with: image: fluxer-unfurl dockerfile: fluxer_unfurl/Dockerfile diff --git a/.github/workflows/build-users.yaml b/.github/workflows/build-users.yaml index 33861b7bd..b36140d36 100644 --- a/.github/workflows/build-users.yaml +++ b/.github/workflows/build-users.yaml @@ -29,6 +29,7 @@ jobs: image: needs: approve uses: ./.github/workflows/_build-image.yaml + secrets: inherit with: image: fluxer-users dockerfile: fluxer_users/Dockerfile diff --git a/.github/workflows/dispatch-private-marketing-build.yaml b/.github/workflows/dispatch-private-marketing-build.yaml index 0d543da38..b386a33b3 100644 --- a/.github/workflows/dispatch-private-marketing-build.yaml +++ b/.github/workflows/dispatch-private-marketing-build.yaml @@ -40,11 +40,20 @@ jobs: build_version: ${{ steps.inputs.outputs.build_version }} correlation_id: ${{ steps.inputs.outputs.correlation_id }} steps: + - name: Create token + id: create-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 + with: + client-id: ${{ vars.FLUXER_CI_APP_ID }} + private-key: ${{ secrets.FLUXER_CI_APP_KEY }} + owner: fluxerapp + repositories: fluxer + permission-contents: read - name: Resolve trusted build inputs id: inputs env: EVENT_AFTER: ${{ github.event.after }} - GH_TOKEN: ${{ github.token }} + GH_TOKEN: ${{ steps.create-token.outputs.token }} PARENT_SHA: ${{ github.sha }} PUBLIC_REPOSITORY: ${{ github.repository }} RUN_ID: ${{ github.run_id }}