Use Github app for downstream triggering and whatnot.

Author: thekeenant

.github/workflows/build-and-publish.yml

@@ -11,16 +11,24 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v3
+
+      - name: Generate GitHub App Token
+        id: generate-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.MADGRADES_AUTOMATOR_APP_ID }}
+          private-key: ${{ secrets.MADGRADES_AUTOMATOR_PRIVATE_KEY }}
+
       - name: Login to Github Packages
         uses: docker/login-action@v2
         with:
           registry: ghcr.io
-          username: ${{ secrets.PUBLISHING_GITHUB_USERNAME }}
-          password: ${{ secrets.PUBLISHING_GITHUB_TOKEN }}
+          username: ${{ github.repository_owner }}
+          password: ${{ steps.generate-token.outputs.token }}
       - name: Build image and push
         uses: docker/build-push-action@v2
         with:
           context: ./
           tags: |
             ghcr.io/madgrades/madgrades-data:latest
-          push: ${{ github.ref == 'refs/heads/main' }}
+          push: ${{ github.ref == 'refs/heads/main' }}

.github/workflows/trigger-downstream.yml

@@ -6,10 +6,17 @@ jobs:
   notify:
     runs-on: ubuntu-latest
     steps:
+      - name: Generate GitHub App Token
+        id: generate-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.MADGRADES_AUTOMATOR_APP_ID }}
+          private-key: ${{ secrets.MADGRADES_AUTOMATOR_PRIVATE_KEY }}
+
       - name: Trigger submodule-updated workflow in Madgrades/reports
         run: |
           curl -X POST \
             -H "Accept: application/vnd.github.v3+json" \
-            -H "Authorization: token ${{ secrets.ACTIONS_GITHUB_TOKEN }}" \
+            -H "Authorization: token ${{ steps.generate-token.outputs.token }}" \
             https://api.github.com/repos/Madgrades/reports/dispatches \
             -d '{"event_type":"submodule-updated"}'