mirror of
https://github.com/vercel/next.js.git
synced 2026-09-20 02:25:18 +08:00
Zack Tanner
a3bb370b00
Moves all release workflows off of a GH PAT and uses an app with a
short-lived token instead.
Test Plan:
Dry run
[here](https://github.com/vercel/next.js/actions/runs/24934593874).
However, this workflow is blocked until we figure out commit signing for
the bot app. Some options:
- The bot account generates a signing key and we use it in CI (not
great, bypasses the app)
- The org bypasses signature verification for the bot user (also not
great, requires an exemption rule)
- We need to rework the commit step so Lerna does not do the push, and
instead trigger it via the app + GH API. This seems like the best
option, will be added in a follow-up PR.
Note: `create-release-branch` workflow is broken in its current form, as
we will not be restoring administrator privileges to adjust environment
settings. This will become a manual step in the future.
(cherry picked from commit e69de2ffaf)
75 lines
1.8 KiB
JavaScript
75 lines
1.8 KiB
JavaScript
// @ts-check
|
|
|
|
const execa = require('execa')
|
|
|
|
const REPO_URL = 'github.com/vercel/next.js.git'
|
|
|
|
function getGitHubToken() {
|
|
return (
|
|
process.env.RELEASE_GITHUB_TOKEN || process.env.RELEASE_BOT_GITHUB_TOKEN
|
|
)
|
|
}
|
|
|
|
function getGitHubTokenMissingMessage() {
|
|
return 'Missing RELEASE_GITHUB_TOKEN or RELEASE_BOT_GITHUB_TOKEN'
|
|
}
|
|
|
|
function getGitUser() {
|
|
const appSlug = process.env.RELEASE_GITHUB_APP_SLUG
|
|
const appUserId = process.env.RELEASE_GITHUB_APP_USER_ID
|
|
|
|
if (appSlug && appUserId) {
|
|
return {
|
|
name: `${appSlug}[bot]`,
|
|
email: `${appUserId}+${appSlug}[bot]@users.noreply.github.com`,
|
|
}
|
|
}
|
|
|
|
return {
|
|
name: process.env.RELEASE_GITHUB_USER_NAME || 'nextjs-bot',
|
|
email: process.env.RELEASE_GITHUB_USER_EMAIL || 'it+nextjs-bot@vercel.com',
|
|
}
|
|
}
|
|
|
|
async function configureGitHubAuth(token) {
|
|
const gitUser = getGitUser()
|
|
const remoteUrl = `https://x-access-token:${encodeURIComponent(
|
|
token
|
|
)}@${REPO_URL}`
|
|
|
|
await execa('git', ['remote', 'set-url', 'origin', remoteUrl], {
|
|
stdio: 'inherit',
|
|
})
|
|
await execa('git', ['config', 'user.name', gitUser.name], {
|
|
stdio: 'inherit',
|
|
})
|
|
await execa('git', ['config', 'user.email', gitUser.email], {
|
|
stdio: 'inherit',
|
|
})
|
|
}
|
|
|
|
async function verifyGitHubApiAccess(token, path, label) {
|
|
const response = await fetch(`https://api.github.com${path}`, {
|
|
headers: {
|
|
Accept: 'application/vnd.github+json',
|
|
Authorization: `Bearer ${token}`,
|
|
'X-GitHub-Api-Version': '2022-11-28',
|
|
},
|
|
})
|
|
|
|
if (!response.ok) {
|
|
throw new Error(
|
|
`Failed to verify GitHub API access for ${label} (${response.status}): ${await response.text()}`
|
|
)
|
|
}
|
|
|
|
console.log(`Verified GitHub API access for ${label}`)
|
|
}
|
|
|
|
module.exports = {
|
|
configureGitHubAuth,
|
|
getGitHubToken,
|
|
getGitHubTokenMissingMessage,
|
|
verifyGitHubApiAccess,
|
|
}
|