Add GitHub App token generation and dispatch job for System Agent Upg…

…rade workflow.
rancher · Dec 2, 2024 · ba44969 · ba44969
1 parent b8c28d0
commit ba44969
Showing 1 changed file with 51 additions and 1 deletion.
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -296,9 +296,59 @@ jobs:
             sha256sum "$file" >> dist/sha256sum.txt
           done
           mv tmp/* dist
+  
+      - name: Read App Secrets
+        uses: rancher-eio/read-vault-secrets@main
+        with:
+          secrets: |
+            secret/data/github/repo/${{ github.repository }}/github/app-credentials appId | APP_ID ;
+            secret/data/github/repo/${{ github.repository }}/github/app-credentials privateKey | PRIVATE_KEY
+
+      - name: Create App Token
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ env.APP_ID }}
+          private-key: ${{ env.PRIVATE_KEY }}
 
       - name: Create release
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run:
           gh release create ${{ github.ref_name }} --verify-tag --generate-notes dist/*
+
+  dispatch:
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    needs: github_release
+    strategy:
+      fail-fast: false
+      matrix:
+        target-branch: [release/v2.8, release/v2.9, main]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Read App Secrets
+        uses: rancher-eio/read-vault-secrets@main
+        with:
+          secrets: |
+            secret/data/github/repo/${{ github.repository }}/github/app-credentials appId | APP_ID ;
+            secret/data/github/repo/${{ github.repository }}/github/app-credentials privateKey | PRIVATE_KEY
+
+      - name: Create App Token
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ env.APP_ID }}
+          private-key: ${{ env.PRIVATE_KEY }}
+
+      - name: Run dispatch
+        run: |
+          ACTION_TARGET_BRANCH=${{ matrix.target-branch }}
+          echo "Dispatching to $ACTION_TARGET_BRANCH branch of rancher/rancher"
+          gh workflow run "System Agent Upgrade" --repo rancher/rancher --ref $ACTION_TARGET_BRANCH -F system_agent_version=${{ github.ref_name }} -F source_author=${{ github.actor }}
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}