[dev-v2.10] fix permissions for forks (#5039)

rancher · Jan 24, 2025 · 0c8cce4 · 0c8cce4
1 parent c672bc4
commit 0c8cce4
Showing 1 changed file with 19 additions and 9 deletions.
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
@@ -21,9 +21,8 @@ jobs:
           GH_VERSION: 2.63.2
           YQ_VERSION: "v4.44.2"
         run: |
-          echo "installing docker jq git make go awk through zypper"
+          echo "installing docker, jq, git, make, go, awk and patch through zypper"
           zypper --non-interactive install docker jq git make go awk patch
-
           echo "installing gh"
           mkdir -p /tmp/gh
           curl -fsL https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_amd64.tar.gz | tar xvzf - --strip-components=1 -C /tmp/gh
@@ -43,21 +42,30 @@ jobs:
           secrets: |
             secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials username | DOCKER_USERNAME;
             secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials password | DOCKER_PASSWORD;
+            secret/data/github/repo/${{ github.repository }}/github/app-credentials appId | APP_ID ;
+            secret/data/github/repo/${{ github.repository }}/github/app-credentials privateKey | PRIVATE_KEY
 
-      - name: actions/checkout@v4
-        continue-on-error: false
+      - name: Create App Token
+        continue-on-error: true
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ env.APP_ID }}
+          private-key: ${{ env.PRIVATE_KEY }}
+
+      - name: Checkout repository
         uses: actions/checkout@v4
 
       - name: Git Checkout PR and into new branch
         continue-on-error: false
-        env:
-            GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          echo  "git global configuration"
+          echo "git global configuration"
           git config --global --add safe.directory "$PWD"
           echo $PATH >> $GITHUB_PATH
+          echo "fetch the pull request"
+          git fetch origin pull/${{ github.event.pull_request.number }}/head:pr-${{ github.event.pull_request.number }}
           echo "checkout the PR"
-          gh pr checkout ${{ github.event.pull_request.number }}
+          git checkout pr-${{ github.event.pull_request.number }}
           echo "checkout into a new branch for safety"
           git checkout -b staging-pr-workflow
 
@@ -72,7 +80,9 @@ jobs:
       - name: Release PR Validation Chekpoints
         continue-on-error: false
         if: contains(github.base_ref, 'release-v')
-        run: make validate-release-charts BRANCH=${{ github.event.pull_request.base.ref }} GH_TOKEN=${{ secrets.GITHUB_TOKEN }} PR_NUMBER=${{ github.event.pull_request.number }}
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: make validate-release-charts BRANCH=${{ github.event.pull_request.base.ref }} GH_TOKEN=${{ env.GH_TOKEN }} PR_NUMBER=${{ github.event.pull_request.number }}
 
       - name: Validate index.yaml Vs assets/ dir
         continue-on-error: false