From d5c7b735d2c09ea4e4ae394a19288150e364b78a Mon Sep 17 00:00:00 2001 From: Paul Rastoin <45004772+prastoin@users.noreply.github.com> Date: Tue, 16 Jun 2026 15:18:43 +0200 Subject: [PATCH] ci: migrate cross-repo dispatch senders to workflow_dispatch (actions:write) (#21648) # Introduction Getting rid of the fine grained PAT used to dispatch to internal repositories. Repo dispatch requires the contents write permissions which is too wide for such use Refactored all senders and target to pass through a workflow dispatch instead Creating a centralize app that forges a token with actions: write only provided permissions to mitigate any token exfiltrations --- .github/workflows/cd-deploy-main.yaml | 17 +++- .github/workflows/cd-deploy-tag.yaml | 37 +++---- .github/workflows/ci-ai-catalog-sync.yaml | 15 ++- .github/workflows/claude.yml | 24 +++-- .github/workflows/docs-i18n-pull.yaml | 15 ++- .../external-contributor-pr-auto-draft.yaml | 19 ++-- .github/workflows/i18n-pull.yaml | 15 ++- .github/workflows/i18n-push.yaml | 15 ++- .github/workflows/post-ci-comments.yaml | 24 +++-- .../workflows/pr-auto-review-dispatch.yaml | 17 +++- .github/workflows/preview-env-dispatch.yaml | 21 ++-- .../workflows/visual-regression-dispatch.yaml | 97 ++++++++++++------- .github/workflows/website-i18n-pull.yaml | 15 ++- .github/workflows/website-i18n-push.yaml | 15 ++- .../workflows/website-preview-dispatch.yaml | 40 ++++++-- 15 files changed, 268 insertions(+), 118 deletions(-) diff --git a/.github/workflows/cd-deploy-main.yaml b/.github/workflows/cd-deploy-main.yaml index 9c3213f997..11a6a86ec7 100644 --- a/.github/workflows/cd-deploy-main.yaml +++ b/.github/workflows/cd-deploy-main.yaml @@ -13,9 +13,18 @@ jobs: timeout-minutes: 3 runs-on: ubuntu-latest steps: - - name: Repository Dispatch + - name: Mint twenty-infra dispatch token + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }} + private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }} + owner: twentyhq + repositories: twenty-infra + permission-actions: write + + - name: Trigger twenty-infra deploy env: - GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} run: | - gh api repos/twentyhq/twenty-infra/dispatches \ - -f event_type=auto-deploy-main + gh workflow run auto-deploy-main.yaml --repo twentyhq/twenty-infra --ref main diff --git a/.github/workflows/cd-deploy-tag.yaml b/.github/workflows/cd-deploy-tag.yaml index 8f8140188d..716df8c050 100644 --- a/.github/workflows/cd-deploy-tag.yaml +++ b/.github/workflows/cd-deploy-tag.yaml @@ -7,7 +7,6 @@ on: push: tags: - 'twenty/v*' - - 'sdk/v*' defaults: run: @@ -18,31 +17,19 @@ jobs: timeout-minutes: 3 runs-on: ubuntu-latest steps: - - name: Resolve dispatch event from tag family - id: target - env: - REF_NAME: ${{ github.ref_name }} - run: | - case "$REF_NAME" in - twenty/v*) - event_type=auto-deploy-twenty - ;; - sdk/v*) - event_type=auto-publish-npm - ;; - *) - echo "Unsupported tag '$REF_NAME', expected 'twenty/v*' or 'sdk/v*'." >&2 - exit 1 - ;; - esac - printf 'event_type=%s\n' "$event_type" >> "$GITHUB_OUTPUT" + - name: Mint twenty-infra dispatch token + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }} + private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }} + owner: twentyhq + repositories: twenty-infra + permission-actions: write - - name: Repository Dispatch + - name: Trigger staging CD env: - GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }} - EVENT_TYPE: ${{ steps.target.outputs.event_type }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} REF_NAME: ${{ github.ref_name }} run: | - gh api repos/twentyhq/twenty-infra/dispatches \ - -f "event_type=$EVENT_TYPE" \ - -f "client_payload[github][ref_name]=$REF_NAME" + gh workflow run staging-ci.yaml --repo twentyhq/twenty-infra --ref main -f tag="$REF_NAME" diff --git a/.github/workflows/ci-ai-catalog-sync.yaml b/.github/workflows/ci-ai-catalog-sync.yaml index d30f5ded59..5934616689 100644 --- a/.github/workflows/ci-ai-catalog-sync.yaml +++ b/.github/workflows/ci-ai-catalog-sync.yaml @@ -59,9 +59,20 @@ jobs: labels: ai, automated delete-branch: true + - name: Mint twenty-infra dispatch token + id: app-token + if: steps.changes.outputs.changed == 'true' + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }} + private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }} + owner: twentyhq + repositories: twenty-infra + permission-actions: write + - name: Trigger automerge if: steps.changes.outputs.changed == 'true' env: - GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} run: | - gh api repos/twentyhq/twenty-infra/dispatches -f event_type=automated-pr-ready + gh workflow run automerge-i18n.yaml --repo twentyhq/twenty-infra --ref main diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 060607f667..7efc07ba87 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -183,18 +183,26 @@ jobs: "PG_DATABASE_URL": "postgres://postgres:postgres@localhost:5432/default" } } + - name: Mint ci-privileged dispatch token + id: app-token + if: always() + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }} + private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }} + owner: twentyhq + repositories: ci-privileged + permission-actions: write + - name: Dispatch response to ci-privileged if: always() env: - GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} REPO: ${{ steps.prompt.outputs.repo }} ISSUE_NUMBER: ${{ steps.prompt.outputs.issue_number }} - RUN_ID: ${{ github.run_id }} RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} run: | - gh api repos/twentyhq/ci-privileged/dispatches \ - -f event_type=claude-cross-repo-response \ - -f "client_payload[repo]=$REPO" \ - -f "client_payload[issue_number]=$ISSUE_NUMBER" \ - -f "client_payload[run_id]=$RUN_ID" \ - -f "client_payload[run_url]=$RUN_URL" + gh workflow run post-claude-response.yaml --repo twentyhq/ci-privileged --ref main \ + -f repo="$REPO" \ + -f issue_number="$ISSUE_NUMBER" \ + -f run_url="$RUN_URL" diff --git a/.github/workflows/docs-i18n-pull.yaml b/.github/workflows/docs-i18n-pull.yaml index 7138e2540a..bcb0146a7f 100644 --- a/.github/workflows/docs-i18n-pull.yaml +++ b/.github/workflows/docs-i18n-pull.yaml @@ -151,9 +151,20 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + - name: Mint twenty-infra dispatch token + id: app-token + if: github.event_name != 'pull_request' && steps.check_changes.outputs.changes_detected == 'true' + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }} + private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }} + owner: twentyhq + repositories: twenty-infra + permission-actions: write + - name: Trigger i18n automerge if: github.event_name != 'pull_request' && steps.check_changes.outputs.changes_detected == 'true' env: - GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} run: | - gh api repos/twentyhq/twenty-infra/dispatches -f event_type=i18n-pr-ready + gh workflow run automerge-i18n.yaml --repo twentyhq/twenty-infra --ref main diff --git a/.github/workflows/external-contributor-pr-auto-draft.yaml b/.github/workflows/external-contributor-pr-auto-draft.yaml index 97fbd907eb..0b429b7edf 100644 --- a/.github/workflows/external-contributor-pr-auto-draft.yaml +++ b/.github/workflows/external-contributor-pr-auto-draft.yaml @@ -16,13 +16,20 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: + - name: Mint ci-privileged dispatch token + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }} + private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }} + owner: twentyhq + repositories: ci-privileged + permission-actions: write + - name: Dispatch to ci-privileged env: - GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} PR_NUMBER: ${{ github.event.pull_request.number }} - PR_NODE_ID: ${{ github.event.pull_request.node_id }} run: | - gh api repos/twentyhq/ci-privileged/dispatches \ - -f event_type=convert-pr-to-draft \ - -f "client_payload[pr_number]=$PR_NUMBER" \ - -f "client_payload[pr_node_id]=$PR_NODE_ID" + gh workflow run convert-pr-to-draft.yaml --repo twentyhq/ci-privileged --ref main \ + -f pr_number="$PR_NUMBER" diff --git a/.github/workflows/i18n-pull.yaml b/.github/workflows/i18n-pull.yaml index d89569aaf3..4c1a81f16f 100644 --- a/.github/workflows/i18n-pull.yaml +++ b/.github/workflows/i18n-pull.yaml @@ -137,9 +137,20 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + - name: Mint twenty-infra dispatch token + id: app-token + if: steps.compile_translations.outputs.changes_detected == 'true' + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }} + private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }} + owner: twentyhq + repositories: twenty-infra + permission-actions: write + - name: Trigger i18n automerge if: steps.compile_translations.outputs.changes_detected == 'true' env: - GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} run: | - gh api repos/twentyhq/twenty-infra/dispatches -f event_type=i18n-pr-ready + gh workflow run automerge-i18n.yaml --repo twentyhq/twenty-infra --ref main diff --git a/.github/workflows/i18n-push.yaml b/.github/workflows/i18n-push.yaml index 7c608b27c7..ca0fd4d5fe 100644 --- a/.github/workflows/i18n-push.yaml +++ b/.github/workflows/i18n-push.yaml @@ -103,9 +103,20 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + - name: Mint twenty-infra dispatch token + id: app-token + if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true' + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }} + private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }} + owner: twentyhq + repositories: twenty-infra + permission-actions: write + - name: Trigger i18n automerge if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true' env: - GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} run: | - gh api repos/twentyhq/twenty-infra/dispatches -f event_type=i18n-pr-ready + gh workflow run automerge-i18n.yaml --repo twentyhq/twenty-infra --ref main diff --git a/.github/workflows/post-ci-comments.yaml b/.github/workflows/post-ci-comments.yaml index f12f83c7c9..711d37cf88 100644 --- a/.github/workflows/post-ci-comments.yaml +++ b/.github/workflows/post-ci-comments.yaml @@ -61,18 +61,28 @@ jobs: core.setOutput('has_pr', 'true'); core.info(`PR #${prNumber}, Run ID: ${runId}`); + - name: Mint ci-privileged dispatch token + id: app-token + if: steps.pr-info.outputs.has_pr == 'true' + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }} + private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }} + owner: twentyhq + repositories: ci-privileged + permission-actions: write + - name: Dispatch to ci-privileged if: steps.pr-info.outputs.has_pr == 'true' env: - GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} PR_NUMBER: ${{ steps.pr-info.outputs.pr_number }} RUN_ID: ${{ steps.pr-info.outputs.run_id }} REPOSITORY: ${{ github.repository }} BRANCH_STATE: ${{ github.event.workflow_run.head_branch }} run: | - gh api repos/twentyhq/ci-privileged/dispatches \ - -f event_type=breaking-changes-report \ - -f "client_payload[pr_number]=$PR_NUMBER" \ - -f "client_payload[run_id]=$RUN_ID" \ - -f "client_payload[repo]=$REPOSITORY" \ - -f "client_payload[branch_state]=$BRANCH_STATE" + gh workflow run post-breaking-changes-comment.yaml --repo twentyhq/ci-privileged --ref main \ + -f pr_number="$PR_NUMBER" \ + -f run_id="$RUN_ID" \ + -f repo="$REPOSITORY" \ + -f branch_state="$BRANCH_STATE" diff --git a/.github/workflows/pr-auto-review-dispatch.yaml b/.github/workflows/pr-auto-review-dispatch.yaml index be82c59468..5813d03570 100644 --- a/.github/workflows/pr-auto-review-dispatch.yaml +++ b/.github/workflows/pr-auto-review-dispatch.yaml @@ -16,11 +16,20 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: + - name: Mint ci-privileged dispatch token + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }} + private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }} + owner: twentyhq + repositories: ci-privileged + permission-actions: write + - name: Dispatch to ci-privileged env: - GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} PR_NUMBER: ${{ github.event.pull_request.number }} run: | - gh api repos/twentyhq/ci-privileged/dispatches \ - -f event_type=pr-review \ - -f "client_payload[pr_number]=$PR_NUMBER" + gh workflow run pr-review.yaml --repo twentyhq/ci-privileged --ref main \ + -f pr_number="$PR_NUMBER" diff --git a/.github/workflows/preview-env-dispatch.yaml b/.github/workflows/preview-env-dispatch.yaml index 344030dc75..4c6dc2f5fe 100644 --- a/.github/workflows/preview-env-dispatch.yaml +++ b/.github/workflows/preview-env-dispatch.yaml @@ -33,15 +33,24 @@ jobs: timeout-minutes: 5 runs-on: ubuntu-latest steps: + - name: Mint ci-privileged dispatch token + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }} + private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }} + owner: twentyhq + repositories: ci-privileged + permission-actions: write + - name: Dispatch preview-env to ci-privileged env: - GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} PR_NUMBER: ${{ github.event.pull_request.number }} PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} REPOSITORY: ${{ github.repository }} run: | - gh api repos/twentyhq/ci-privileged/dispatches \ - -f event_type=preview-environment \ - -f "client_payload[pr_number]=$PR_NUMBER" \ - -f "client_payload[pr_head_sha]=$PR_HEAD_SHA" \ - -f "client_payload[repo]=$REPOSITORY" + gh workflow run preview-env.yaml --repo twentyhq/ci-privileged --ref main \ + -f pr_number="$PR_NUMBER" \ + -f pr_head_sha="$PR_HEAD_SHA" \ + -f repo="$REPOSITORY" diff --git a/.github/workflows/visual-regression-dispatch.yaml b/.github/workflows/visual-regression-dispatch.yaml index b83ba12d17..818220eb81 100644 --- a/.github/workflows/visual-regression-dispatch.yaml +++ b/.github/workflows/visual-regression-dispatch.yaml @@ -4,8 +4,9 @@ name: Visual Regression Dispatch # Runs in the context of the base repo (not the fork) so it has access to secrets, # making it work for external contributor PRs. # -# All dispatches use the same event_type=visual-regression with project/artifact_name -# in the payload. ci-privileged routes to the correct Argos project based on these. +# All paths trigger the same ci-privileged workflow (post-visual-regression-comment.yaml) +# via workflow_dispatch, passing the project as an input. ci-privileged routes to the +# correct Argos project based on it. on: workflow_run: @@ -147,9 +148,19 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: + - name: Mint ci-privileged dispatch token + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }} + private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }} + owner: twentyhq + repositories: ci-privileged + permission-actions: write + - name: Dispatch to ci-privileged env: - GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} PROJECT: ${{ needs.resolve-context.outputs.project }} PR_NUMBER: ${{ needs.resolve-context.outputs.pr_number }} WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }} @@ -160,24 +171,22 @@ jobs: ARTIFACT_NAME: ${{ needs.resolve-context.outputs.artifact_name }} run: | ARGS=( - --method POST - -f event_type=visual-regression - -f "client_payload[project]=$PROJECT" - -f "client_payload[artifact_name]=$ARTIFACT_NAME" - -f "client_payload[run_id]=$WORKFLOW_RUN_ID" - -f "client_payload[repo]=$REPOSITORY" - -f "client_payload[branch]=$BRANCH" - -f "client_payload[commit]=$COMMIT" + -f project="$PROJECT" + -f artifact_name="$ARTIFACT_NAME" + -f run_id="$WORKFLOW_RUN_ID" + -f repo="$REPOSITORY" + -f branch="$BRANCH" + -f commit="$COMMIT" ) if [ -n "$PR_NUMBER" ]; then - ARGS+=(-f "client_payload[pr_number]=$PR_NUMBER") + ARGS+=(-f pr_number="$PR_NUMBER") fi if [ -n "$REFERENCE_COMMIT" ]; then - ARGS+=(-f "client_payload[reference_commit]=$REFERENCE_COMMIT") + ARGS+=(-f reference_commit="$REFERENCE_COMMIT") fi - gh api repos/twentyhq/ci-privileged/dispatches "${ARGS[@]}" + gh workflow run post-visual-regression-comment.yaml --repo twentyhq/ci-privileged --ref main "${ARGS[@]}" # ── Dispatch: cross-comparison baseline (CI UI on main → twenty-ui-vs-new-ui) ── dispatch-comparison-baseline: @@ -190,24 +199,32 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: + - name: Mint ci-privileged dispatch token + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }} + private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }} + owner: twentyhq + repositories: ci-privileged + permission-actions: write + - name: Dispatch to ci-privileged (comparison baseline) env: - GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }} REPOSITORY: ${{ github.repository }} BRANCH: ${{ github.event.workflow_run.head_branch }} COMMIT: ${{ github.event.workflow_run.head_sha }} ARTIFACT_NAME: ${{ needs.resolve-context.outputs.artifact_name }} run: | - gh api repos/twentyhq/ci-privileged/dispatches \ - --method POST \ - -f event_type=visual-regression \ - -f "client_payload[project]=twenty-ui-vs-new-ui" \ - -f "client_payload[artifact_name]=$ARTIFACT_NAME" \ - -f "client_payload[run_id]=$WORKFLOW_RUN_ID" \ - -f "client_payload[repo]=$REPOSITORY" \ - -f "client_payload[branch]=$BRANCH" \ - -f "client_payload[commit]=$COMMIT" + gh workflow run post-visual-regression-comment.yaml --repo twentyhq/ci-privileged --ref main \ + -f project="twenty-ui-vs-new-ui" \ + -f artifact_name="$ARTIFACT_NAME" \ + -f run_id="$WORKFLOW_RUN_ID" \ + -f repo="$REPOSITORY" \ + -f branch="$BRANCH" \ + -f commit="$COMMIT" # ── Dispatch: cross-comparison PR (CI New UI on PRs → twenty-ui-vs-new-ui) ── dispatch-comparison-pr: @@ -220,9 +237,19 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: + - name: Mint ci-privileged dispatch token + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }} + private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }} + owner: twentyhq + repositories: ci-privileged + permission-actions: write + - name: Dispatch to ci-privileged (comparison PR) env: - GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }} REPOSITORY: ${{ github.repository }} BRANCH: ${{ github.event.workflow_run.head_branch }} @@ -232,19 +259,17 @@ jobs: ARTIFACT_NAME: ${{ needs.resolve-context.outputs.artifact_name }} run: | ARGS=( - --method POST - -f event_type=visual-regression - -f "client_payload[project]=twenty-ui-vs-new-ui" - -f "client_payload[artifact_name]=$ARTIFACT_NAME" - -f "client_payload[run_id]=$WORKFLOW_RUN_ID" - -f "client_payload[repo]=$REPOSITORY" - -f "client_payload[branch]=$BRANCH" - -f "client_payload[commit]=$COMMIT" - -f "client_payload[pr_number]=$PR_NUMBER" + -f project="twenty-ui-vs-new-ui" + -f artifact_name="$ARTIFACT_NAME" + -f run_id="$WORKFLOW_RUN_ID" + -f repo="$REPOSITORY" + -f branch="$BRANCH" + -f commit="$COMMIT" + -f pr_number="$PR_NUMBER" ) if [ -n "$REFERENCE_COMMIT" ]; then - ARGS+=(-f "client_payload[reference_commit]=$REFERENCE_COMMIT") + ARGS+=(-f reference_commit="$REFERENCE_COMMIT") fi - gh api repos/twentyhq/ci-privileged/dispatches "${ARGS[@]}" + gh workflow run post-visual-regression-comment.yaml --repo twentyhq/ci-privileged --ref main "${ARGS[@]}" diff --git a/.github/workflows/website-i18n-pull.yaml b/.github/workflows/website-i18n-pull.yaml index f03e1c2632..eddd9c88da 100644 --- a/.github/workflows/website-i18n-pull.yaml +++ b/.github/workflows/website-i18n-pull.yaml @@ -126,9 +126,20 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + - name: Mint twenty-infra dispatch token + id: app-token + if: steps.compile_translations.outputs.changes_detected == 'true' + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }} + private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }} + owner: twentyhq + repositories: twenty-infra + permission-actions: write + - name: Trigger i18n automerge if: steps.compile_translations.outputs.changes_detected == 'true' env: - GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} run: | - gh api repos/twentyhq/twenty-infra/dispatches -f event_type=i18n-pr-ready + gh workflow run automerge-i18n.yaml --repo twentyhq/twenty-infra --ref main diff --git a/.github/workflows/website-i18n-push.yaml b/.github/workflows/website-i18n-push.yaml index 05ad8e653f..a308777354 100644 --- a/.github/workflows/website-i18n-push.yaml +++ b/.github/workflows/website-i18n-push.yaml @@ -102,9 +102,20 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + - name: Mint twenty-infra dispatch token + id: app-token + if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true' + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }} + private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }} + owner: twentyhq + repositories: twenty-infra + permission-actions: write + - name: Trigger i18n automerge if: steps.check_extract_changes.outputs.changes_detected == 'true' || steps.check_compile_changes.outputs.changes_detected == 'true' env: - GH_TOKEN: ${{ secrets.TWENTY_INFRA_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} run: | - gh api repos/twentyhq/twenty-infra/dispatches -f event_type=i18n-pr-ready + gh workflow run automerge-i18n.yaml --repo twentyhq/twenty-infra --ref main diff --git a/.github/workflows/website-preview-dispatch.yaml b/.github/workflows/website-preview-dispatch.yaml index 048118bcf3..dac4ddde86 100644 --- a/.github/workflows/website-preview-dispatch.yaml +++ b/.github/workflows/website-preview-dispatch.yaml @@ -35,18 +35,28 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: + - name: Mint ci-privileged dispatch token + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }} + private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }} + owner: twentyhq + repositories: ci-privileged + permission-actions: write + - name: Dispatch website-preview-build to ci-privileged env: - GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} PR_NUMBER: ${{ github.event.pull_request.number }} PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} PR_HEAD_REF: ${{ github.event.pull_request.head.ref }} run: | - gh api repos/twentyhq/ci-privileged/dispatches \ - -f event_type=website-preview-build \ - -f "client_payload[pr_number]=$PR_NUMBER" \ - -f "client_payload[pr_head_sha]=$PR_HEAD_SHA" \ - -f "client_payload[pr_head_ref]=$PR_HEAD_REF" + gh workflow run website-preview.yaml --repo twentyhq/ci-privileged --ref main \ + -f action=build \ + -f pr_number="$PR_NUMBER" \ + -f pr_head_sha="$PR_HEAD_SHA" \ + -f pr_head_ref="$PR_HEAD_REF" trigger-cleanup: # Covers both merge and close-without-merge — pull_request `closed` fires @@ -59,11 +69,21 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: + - name: Mint ci-privileged dispatch token + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }} + private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }} + owner: twentyhq + repositories: ci-privileged + permission-actions: write + - name: Dispatch website-preview-cleanup to ci-privileged env: - GH_TOKEN: ${{ secrets.CI_PRIVILEGED_DISPATCH_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} PR_NUMBER: ${{ github.event.pull_request.number }} run: | - gh api repos/twentyhq/ci-privileged/dispatches \ - -f event_type=website-preview-cleanup \ - -f "client_payload[pr_number]=$PR_NUMBER" + gh workflow run website-preview.yaml --repo twentyhq/ci-privileged --ref main \ + -f action=cleanup \ + -f pr_number="$PR_NUMBER"