Regular gh token, trim write permissions

solarwinds · Nov 21, 2023 · 7f84b95 · 7f84b95
1 parent ee52ae7
commit 7f84b95
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 10 deletions.
diff --git a/.github/workflows/build_publish_pypi_and_draft_release.yaml b/.github/workflows/build_publish_pypi_and_draft_release.yaml
@@ -125,7 +125,8 @@ jobs:
     name: Create draft release
     needs: [build_publish_sdist_and_x86_64, build_publish_aarch64]
     runs-on: ubuntu-latest
-    permissions: write-all
+    permissions:
+      contents: write
     steps:
       - uses: getsentry/action-github-app-token@v2
         id: github-token
@@ -140,4 +141,4 @@ jobs:
       - name: Create draft release
         run: gh release create ${{ env.RELEASE_NAME }} --title "${{ env.RELEASE_NAME }}" --target release/${{ env.RELEASE_NAME }} --draft
         env:
-          GITHUB_TOKEN: ${{ steps.github-token.outputs.token }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/create_release_pr.yaml b/.github/workflows/create_release_pr.yaml
@@ -20,13 +20,10 @@ env:
 jobs:
   create_release_pr:
     runs-on: ubuntu-latest
-    permissions: write-all
+    permissions:
+      pull-requests: write
+      contents: write
     steps:
-      - uses: getsentry/action-github-app-token@v2
-        id: github-token
-        with:
-          app_id: ${{ vars.APPLICATION_ID }}
-          private_key: ${{ secrets.APPLICATION_PRIVATE_KEY }}
       - uses: actions/checkout@v3
       - name: Initialize git
         run: |
@@ -50,8 +47,8 @@ jobs:
       - name: Push new release branch to remote repositories
         run: git push origin release/${{ env.RELEASE_NAME }}
         env:
-          GITHUB_TOKEN: ${{ steps.github-token.outputs.token }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Open draft Pull Request for version bump
         run: gh pr create --draft --title "solarwinds-apm ${{ env.RELEASE_VERSION }}" --body "For PyPI release of solarwinds-apm ${{ env.RELEASE_VERSION }}. See also CHANGELOG.md."
         env:
-          GITHUB_TOKEN: ${{ steps.github-token.outputs.token }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}