ci: Fix app permissions (envoyproxy#174)

Signed-off-by: Ryan Northey <[email protected]>
billowqiu · Jun 3, 2023 · 935d44a · 935d44a
1 parent 5013462
commit 935d44a
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 9 deletions.
diff --git a/.github/workflows/envoy-sync.yaml b/.github/workflows/envoy-sync.yaml
@@ -21,10 +21,17 @@ jobs:
           || github.actor == 'sync-envoy[bot]'
       }}
     steps:
+    - id: appauth
+      uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0
+      with:
+        key: ${{ secrets.ENVOY_CI_UPDATE_BOT_KEY }}
+        app_id: ${{ secrets.ENVOY_CI_UPDATE_APP_ID }}
+
     - name: 'Checkout Repository'
       uses: actions/checkout@v3
       with:
         ref: main
+        token: ${{ steps.appauth.outputs.value }}
 
     # Checkout the Envoy repo at latest commit
     - name: 'Checkout Repository'
@@ -35,13 +42,8 @@ jobs:
         path: upstream
     - run: mv upstream ../envoy
 
-    - id: appauth
-      uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0
-      with:
-        key: ${{ secrets.ENVOY_CI_UPDATE_BOT_KEY }}
-        app_id: ${{ secrets.ENVOY_CI_UPDATE_APP_ID }}
-
     - run: ci/sync_envoy.sh
       env:
         ENVOY_SRC_DIR: ../envoy
-        GITHUB_TOKEN: ${{ steps.appauth.outputs.value }}
+        GITHUB_EMAIL: "135279899+update-envoy[bot]@users.noreply.github.com"
+        GITHUB_NAME: "update-envoy[bot]"
diff --git a/ci/sync_envoy.sh b/ci/sync_envoy.sh
@@ -6,8 +6,8 @@ echo "Updating Submodule..."
 # Update submodule to latest Envoy SHA
 ENVOY_SHA=$(git -C "$ENVOY_SRC_DIR" rev-parse HEAD)
 CURRENT_SHA="$(git  ls-files -s envoy | cut -d' ' -f2)"
-COMMITTER_NAME="envoy-update[bot]"
-COMMITTER_EMAIL="envoy-update[bot]@users.noreply.github.com"
+COMMITTER_NAME="${GITHUB_NAME:-}"
+COMMITTER_EMAIL="${GITHUB_EMAIL:-}"
 
 
 if [[ "$CURRENT_SHA" == "$ENVOY_SHA" ]]; then