@@ -1523,11 +1523,13 @@ jobs:
15231523 # Use a different token to remove the "in-progress" label,
15241524 # to allow the removal to trigger the "Check Labels" workflow.
15251525 - name : Generate token for GitHub API
1526- uses : tibdex/ github-app-token@32691ba7c9e7063bd457bd8f2a5703138591fa58 # ratchet:tibdex/ github-app-token@v1
1526+ uses : actions/create- github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # ratchet:actions/create- github-app-token@v1
15271527 id : generate-token
15281528 with :
1529- app_id : ${{ secrets.WORKFLOW_TRIGGER_APP_ID }}
1530- private_key : ${{ secrets.WORKFLOW_TRIGGER_APP_PRIVATE_KEY }}
1529+ # we should migrate to client-id
1530+ app-id : ${{ secrets.WORKFLOW_TRIGGER_APP_ID }}
1531+ private-key : ${{ secrets.WORKFLOW_TRIGGER_APP_PRIVATE_KEY }}
1532+ permission-pull-requests : write
15311533 - name : Update PR label and comment
15321534 if : ${{ needs.check_and_prepare.outputs.pr_number }}
15331535 shell : bash
@@ -1596,11 +1598,13 @@ jobs:
15961598 run : pip install -r scripts/gha/python_requirements.txt
15971599 # The default token can't run workflows, so get an alternate token.
15981600 - name : Generate token for GitHub API
1599- uses : tibdex/ github-app-token@32691ba7c9e7063bd457bd8f2a5703138591fa58 # ratchet:tibdex/ github-app-token@v1
1601+ uses : actions/create- github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # ratchet:actions/create- github-app-token@v1
16001602 id : generate-token
16011603 with :
1602- app_id : ${{ secrets.WORKFLOW_TRIGGER_APP_ID }}
1603- private_key : ${{ secrets.WORKFLOW_TRIGGER_APP_PRIVATE_KEY }}
1604+ # we should migrate to client-id
1605+ app-id : ${{ secrets.WORKFLOW_TRIGGER_APP_ID }}
1606+ private-key : ${{ secrets.WORKFLOW_TRIGGER_APP_PRIVATE_KEY }}
1607+ permission-actions : write
16041608 - name : Retry failed tests
16051609 run : |
16061610 echo "::warning ::Attempting to retry failed tests"
0 commit comments