Update build_assets to use release bot auth

Author: spalmurray

.github/workflows/build_assets.yml

@@ -31,6 +31,7 @@ jobs:
               lipo -archs dist/codecovcli_macos | grep 'x86_64 arm64'
             OUT_FILE_NAME: codecovcli_macos
             ASSET_MIME: application/octet-stream
+
           - os: ubuntu-22.04
             TARGET: ubuntu
             CMD_REQS: >
@@ -41,6 +42,7 @@ jobs:
               cp ./dist/main ./dist/codecovcli_linux
             OUT_FILE_NAME: codecovcli_linux
             ASSET_MIME: application/octet-stream
+
           - os: windows-latest
             TARGET: windows
             CMD_REQS: >
@@ -50,35 +52,50 @@ jobs:
               Copy-Item -Path ".\dist\main.exe" -Destination ".\dist\codecovcli_windows.exe"
             OUT_FILE_NAME: codecovcli_windows.exe
             ASSET_MIME: application/vnd.microsoft.portable-executable
+
     steps:
       - uses: actions/checkout@v4
         with:
           submodules: true
+
       - name: Set up Python 3.11
         uses: actions/setup-python@v3
         with:
           python-version: "3.11"
+
       - name: Install dependencies
         run: |
           cd codecov-cli
           ${{matrix.CMD_REQS}}
           python setup.py build
+
       - name: Install pyinstaller
         run: pip install pyinstaller
+
       - name: Build with pyinstaller for ${{matrix.TARGET}}
         run: cd codecov-cli && ${{matrix.CMD_BUILD}}
+
       - name: Upload a Build Artifact
         uses: actions/upload-artifact@v4
         if: inputs.release == false
         with:
           name: ${{ matrix.OUT_FILE_NAME }}
           path: ./codecov-cli/dist/${{ matrix.OUT_FILE_NAME }}
+
+      - name: Get auth token
+        if: inputs.release == true
+        id: token
+        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        with:
+          app-id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }}
+          private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
+
       - name: Upload Release Asset
         if: inputs.release == true
         id: upload-release-asset
         uses: svenstaro/upload-release-action@v2
         with:
-          repo_token: ${{ secrets.GITHUB_TOKEN }}
+          repo_token: ${{ steps.token.outputs.token }}
           file: ./codecov-cli/dist/${{ matrix.OUT_FILE_NAME }}
           asset_name: ${{ matrix.OUT_FILE_NAME }}
           tag: ${{ github.ref }}
@@ -104,10 +121,12 @@ jobs:
     - uses: actions/checkout@v4
       with:
         submodules: true
+
     - name: Set up QEMU
       uses: docker/setup-qemu-action@v1
       with:
         platforms: ${{ matrix.arch }}
+
     - name: Run in Docker
       run: |
         docker run \
@@ -117,18 +136,28 @@ jobs:
           --platform linux/${{ matrix.arch }} \
           ${{ matrix.distro }} \
           ./codecov-cli/scripts/build_${{ matrix.distro_name }}_arm.sh ${{ matrix.distro_name }}_${{ matrix.arch }}
+
     - name: Upload a Build Artifact
       uses: actions/upload-artifact@v4
       if: inputs.release == false
       with:
         name: codecovcli_${{ matrix.distro_name }}_${{ matrix.arch }}
         path: ./codecov-cli/dist/codecovcli_${{ matrix.distro_name }}_${{ matrix.arch }}
+
+    - name: Get auth token
+      if: inputs.release == true
+      id: token
+      uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+      with:
+        app-id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }}
+        private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
+
     - name: Upload Release Asset
       if: inputs.release == true
       id: upload-release-asset
       uses: svenstaro/upload-release-action@v2
       with:
-        repo_token: ${{ secrets.GITHUB_TOKEN }}
+        repo_token: ${{ steps.token.outputs.token }}
         file: ./codecov-cli/dist/codecovcli_${{ matrix.distro_name }}_${{ matrix.arch }}
         asset_name: codecovcli_${{ matrix.distro_name }}_${{ matrix.arch }}
         tag: ${{ github.ref }}

.github/workflows/build_for_pypi.yml

@@ -10,23 +10,25 @@ on:
         description: "Build for PyPi"
 
 jobs:
-
   build_src_for_pypi:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
           persist-credentials: false
           submodules: true
+
       - name: Install dependencies
         run: |
           pip install build
+
       - name: Build src dist
         run: |
           cd codecov-cli
           python -m build --sdist
         env:
           PIP_CONSTRAINT: requirements.txt
+
       - name: Store the distribution packages
         uses: actions/upload-artifact@v4
         with:
@@ -50,15 +52,18 @@ jobs:
         uses: actions/download-artifact@v4
         with:
           name: cibw-sdist
+
       - name: Get sdist filename
         id: get-sdist
         run: |
           echo "sdist_filename=$(ls codecov-cli/dist/)" >> "${GITHUB_OUTPUT}"
         shell: bash
+        
       - name: Build wheels
         uses: pypa/cibuildwheel@v2.22.0
         with:
           package-dir: codecov-cli/dist/${{ steps.get-sdist.outputs.sdist_filename }}
+
       - name: Store the distribution packages
         uses: actions/upload-artifact@v4
         with:

.github/workflows/ci-job.yml

@@ -14,17 +14,20 @@ jobs:
       with:
         submodules: true
         fetch-depth: 2
+
     - name: Set up Python 3.12
       uses: actions/setup-python@v5
       with:
         python-version: "3.12"
+
     - name: Install dependencies
       run: |
         cd codecov-cli
         python -m pip install --upgrade pip
         pip install -r requirements.txt
         python -m pip install -e .
         pip install -r tests/requirements.txt
+
     - name: Test with pytest
       run: |
         cd codecov-cli

.github/workflows/ci.yml

@@ -18,6 +18,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           submodules: true
+
       - name: Check linting with ruff
         run: |
           make lint
@@ -28,18 +29,22 @@ jobs:
       - uses: actions/checkout@v4
         with:
           submodules: true
+
       - name: Set up Python 3.12
         uses: actions/setup-python@v5
         with:
           python-version: "3.12"
+
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
           python -m pip install -e codecov-cli
           python -m pip install -e prevent-cli
+
       - name: Run command_dump
         run: |
           ./command_dump.py
+
       - name: Detect changes on commit
         run: |
           if [ -n "$(git diff codecov-cli/codecovcli_commands prevent-cli/preventcli_commands)" ]; then
@@ -56,16 +61,20 @@ jobs:
         with:
           submodules: true
           fetch-depth: 2
+
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
+
       - name: Install CLI
         # todo: update this to dogfood prevent cli, maybe try both?
         run: |
           pip install codecov-cli
+
       - name: Create commit in codecov
         run: |
           codecovcli create-commit -t ${{ secrets.CODECOV_TOKEN }} --git-service github
+
       - name: Create commit report in codecov
         run: |
           codecovcli create-report -t ${{ secrets.CODECOV_TOKEN }} --git-service github
@@ -82,27 +91,32 @@ jobs:
         with:
           submodules: true
           fetch-depth: 2
+
       - name: Set up Python ${{matrix.python-version}}
         uses: actions/setup-python@v5
         with:
           python-version: "${{matrix.python-version}}"
+
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
           python -m pip install -e codecov-cli
           python -m pip install -e prevent-cli
           pip install -r codecov-cli/tests/requirements.txt
+
       - name: Test with pytest
         run: |
           cd codecov-cli
           pytest --cov --junitxml=${{matrix.os}}-${{matrix.python-version}}junit.xml
         env:
           CODECOV_ENV: test
+
       - name: Dogfooding codecov-cli
         if: ${{ !github.event.pull_request.head.repo.fork && github.repository_owner == 'getsentry' }}
         run: |
           codecovcli -v do-upload --fail-on-error -t ${{ secrets.CODECOV_TOKEN }} --plugin pycoverage --flag python${{matrix.python-version}} --flag codecovcli
           codecovcli do-upload --report-type test_results --fail-on-error -t ${{ secrets.CODECOV_TOKEN }} --plugin pycoverage --flag python${{matrix.python-version}} --flag codecovcli
+
       - name: Dogfooding sentry-prevent-cli
         if: ${{ !github.event.pull_request.head.repo.fork && github.repository_owner == 'getsentry' }}
         run: |

.github/workflows/release_flow.yml

@@ -37,6 +37,7 @@ jobs:
         with:
           path: dist/
           pattern: cibw-*
+
       - name: Display and move artifacts
         run: |
           ls -alrt */*/*
@@ -47,6 +48,7 @@ jobs:
           echo "Deleting empty directories"
           find . -empty -type d -delete
           ls -alrt */*
+
       - name: Publish package to PyPi
         uses: pypa/gh-action-pypi-publish@release/v1
         with: