Skip to content

Refactor sync workflow to use Github App - #115

Open
pdabelf5 wants to merge 2 commits into
mainfrom
chore/github-app-for-sync
Open

Refactor sync workflow to use Github App#115
pdabelf5 wants to merge 2 commits into
mainfrom
chore/github-app-for-sync

Conversation

@pdabelf5

@pdabelf5 pdabelf5 commented Sep 4, 2026

Copy link
Copy Markdown
Collaborator

Proposed changes

This pull request updates the GitHub Actions workflows to improve security and modernize authentication for repository automation. The main changes involve removing the legacy Dependabot auto-merge workflow and refactoring the sync.yml workflow to use GitHub App tokens fetched from a vault, instead of personal access tokens.

Workflow deprecation:

  • Removed the .github/workflows/dependabot-auto-merge.yml workflow, discontinuing automatic merging of Dependabot PRs.

Authentication and security improvements:

  • Updated the sync.yml workflow to fetch GitHub App credentials from a vault using the get-from-vault action, and mint short-lived GitHub App tokens for each organization and repository, replacing the use of static personal access tokens.
  • Added explicit id-token: write and contents: read permissions for jobs, following GitHub Actions security best practices.

Repository sync and label management updates:

  • Refactored the label sync step to use the new GitHub App tokens and updated repository references from nginxinc to nginx where appropriate.
  • Split repository sync steps to use the appropriate minted token for each organization, ensuring least-privilege access.

Checklist

Before creating a PR, run through this checklist and mark each as complete:

@pdabelf5 pdabelf5 self-assigned this Sep 4, 2026
@pdabelf5
pdabelf5 force-pushed the chore/github-app-for-sync branch from 4d58cd9 to eaf6e34 Compare September 4, 2026 16:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant