Merge pull request #8960 from kewisch/botmobile

kewisch · coreycb · commit 6db94c19027a · 2025-05-03T15:23:18.000-04:00
Use botmobile for commenting
diff --git a/.github/workflows/daily_builds.yml b/.github/workflows/daily_builds.yml
@@ -14,5 +14,4 @@ jobs:
     uses: ./.github/workflows/shippable_builds.yml
     secrets: inherit
     permissions:
-      contents: write # For release bumps
       id-token: write # For GCS publishing (ftp.mo)
diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
@@ -10,20 +10,30 @@ on:
 
   workflow_dispatch:
 
-permissions:
-  contents: write
-
 concurrency:
   group: "pages"
   cancel-in-progress: false
 
+
+environment: botmobile
+
 jobs:
   build-docs:
     if: ${{ github.repository_owner == 'thunderbird' }}
     runs-on: ubuntu-latest
     steps:
+      - name: App token generate
+        uses: actions/create-github-app-token@21cfef2b496dd8ef5b904c159339626a10ad380e  # v1.11.6
+        if: ${{ vars.BOT_CLIENT_ID }}
+        id: app-token
+        with:
+          app-id: ${{ vars.BOT_CLIENT_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        with:
+          token: ${{ steps.app-token.outputs.token || github.token }}
 
       - name: Cargo cache
         uses: actions-rust-lang/setup-rust-toolchain@9399c7bb15d4c7d47b27263d024f0a4978346ba4  # v1.11.0
@@ -44,9 +54,12 @@ jobs:
           rm book/docs/latest/install.sh
 
       - name: Deploy docs to gh-pages
+        env:
+          APP_SLUG: ${{ steps.app-token.outputs.app-slug || 'github-actions'}}
+          APP_USER_ID: ${{ vars.BOT_USER_ID || '41898282' }}
         run: |
-          git config --global user.name "github-actions[bot]"
-          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+          git config --global user.name "${APP_SLUG}"
+          git config --global user.email "${APP_USER_ID}+${APP_SLUG}[bot]@users.noreply.github.com"
 
           # Fetch the gh-pages branch
           git fetch origin gh-pages || git checkout --orphan gh-pages
diff --git a/.github/workflows/needinfo-answered.yml b/.github/workflows/needinfo-answered.yml
@@ -10,6 +10,8 @@ on:
 permissions:
   issues: write
 
+environment: botmobile
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -20,9 +22,17 @@ jobs:
       issues: write
       pull-requests: write
     steps:
+      - name: App token generate
+        uses: actions/create-github-app-token@21cfef2b496dd8ef5b904c159339626a10ad380e  # v1.11.6
+        if: ${{ vars.BOT_CLIENT_ID }}
+        id: app-token
+        with:
+          app-id: ${{ vars.BOT_CLIENT_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+
       - name: Remove answered label if both exist
         env:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
         run: |
           gh issue edit $ISSUE_NUMBER --repo "$GITHUB_REPOSITORY" --remove-label "status: answered"
diff --git a/.github/workflows/needinfo-remove.yml b/.github/workflows/needinfo-remove.yml
@@ -10,6 +10,8 @@ permissions:
   contents: read
   issues: write
 
+environment: botmobile
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -22,9 +24,17 @@ jobs:
       issues: write
       pull-requests: write
     steps:
+      - name: App token generate
+        uses: actions/create-github-app-token@21cfef2b496dd8ef5b904c159339626a10ad380e  # v1.11.6
+        if: ${{ vars.BOT_CLIENT_ID }}
+        id: app-token
+        with:
+          app-id: ${{ vars.BOT_CLIENT_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+
       - name: Remove needinfo label and add answered label
         env:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
         run: |
           gh issue edit $ISSUE_NUMBER --repo "$GITHUB_REPOSITORY" --remove-label "status: needs information" --add-label "status: answered"
diff --git a/.github/workflows/needinfo-stale.yml b/.github/workflows/needinfo-stale.yml
@@ -10,17 +10,27 @@ permissions:
   contents: read
   issues: write
 
+environment: botmobile
+
 jobs:
   build:
     runs-on: ubuntu-latest
     permissions:
       issues: write
       pull-requests: write
     steps:
+      - name: App token generate
+        uses: actions/create-github-app-token@21cfef2b496dd8ef5b904c159339626a10ad380e  # v1.11.6
+        if: ${{ vars.BOT_CLIENT_ID }}
+        id: app-token
+        with:
+          app-id: ${{ vars.BOT_CLIENT_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+
       - name: Close old issues with the needinfo tag
-        uses: imhoffd/needs-reply@71e8d5144caa0d4a1e292348bfafa3866d08c855 # v2.0.0
+        uses: imhoffd/needs-reply@71e8d5144caa0d4a1e292348bfafa3866d08c855  # v2.0.0
         with:
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          repo-token: ${{ steps.app-token.outputs.token || github.token }}
           issue-label: "status: needs information"
           days-before-close: 30
           close-message: >
diff --git a/.github/workflows/pulls-merged.yml b/.github/workflows/pulls-merged.yml
@@ -12,16 +12,26 @@ permissions:
   pull-requests: write
   issues: write
 
+environment: botmobile
+
 jobs:
   pull-request-merged:
     runs-on: ubuntu-latest
 
     steps:
+      - name: App token generate
+        uses: actions/create-github-app-token@21cfef2b496dd8ef5b904c159339626a10ad380e  # v1.11.6
+        if: ${{ vars.BOT_CLIENT_ID }}
+        id: app-token
+        with:
+          app-id: ${{ vars.BOT_CLIENT_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+
       - name: Get active milestone
         id: milestone
         env:
           PR_NUMBER: ${{  github.event.pull_request.number  }}
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
         run: |
           # The furthest open milestone in the future should be current main
           gh api repos/$GITHUB_REPOSITORY/milestones --jq '
@@ -39,7 +49,7 @@ jobs:
           github.event.pull_request.author_association != 'COLLABORATOR'
         env:
           PR_NUMBER: ${{  github.event.pull_request.number  }}
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
           MILESTONE: ${{ steps.milestone.outputs.title }}
           MESSAGE: >-
             Thanks for your contribution! Your pull request has been merged and will be part of
@@ -55,7 +65,7 @@ jobs:
       - name: Set active milestone on PR
         env:
           PR_NUMBER: ${{  github.event.pull_request.number  }}
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
           MILESTONE: ${{ steps.milestone.outputs.number }}
         run: |
           gh api --method PATCH /repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER -f milestone=$MILESTONE
diff --git a/.github/workflows/shippable_builds.yml b/.github/workflows/shippable_builds.yml
@@ -197,8 +197,6 @@ jobs:
       max-parallel: 1
       matrix:
         include: "${{ fromJSON(needs.dump_config.outputs.matrixInclude) }}"
-    permissions:
-      contents: write
     outputs:
       k9mail_sha: ${{ steps.commit.outputs.k9mail_sha }}
       thunderbird_sha: ${{ steps.commit.outputs.thunderbird_sha }}
@@ -207,11 +205,20 @@ jobs:
       old_version_code: ${{ steps.new_version_code.outputs.old_version_code }}
       new_version_code: ${{ steps.new_version_code.outputs.new_version_code }}
     steps:
+      - name: App Token Generate
+        uses: actions/create-github-app-token@21cfef2b496dd8ef5b904c159339626a10ad380e # v1.11.6
+        if: ${{ vars.BOT_CLIENT_ID }}
+        id: app-token
+        with:
+          app-id: ${{ vars.BOT_CLIENT_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+
       - name: Checkout repository
         if: ${{ contains(matrix.releaseTarget, 'github') || needs.dump_config.outputs.releaseType == 'daily' }}
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
+          token: ${{ steps.app-token.outputs.token || github.token }}
 
       - name: Copy CI gradle.properties
         if: ${{ contains(matrix.releaseTarget, 'github') || needs.dump_config.outputs.releaseType == 'daily' }}
@@ -369,9 +376,11 @@ jobs:
           APP_NAME: ${{ matrix.appName }}
           FULL_VERSION_NAME: ${{ steps.appinfo.outputs.VERSION_NAME }}${{ steps.bump_version_suffix.outputs.SUFFIX || steps.appinfo.outputs.VERSION_NAME_SUFFIX }}
           RELEASE_TYPE: ${{ vars.RELEASE_TYPE }}
+          APP_SLUG: ${{ steps.app-token.outputs.app-slug || 'github-actions'}}
+          APP_USER_ID: ${{ vars.BOT_USER_ID || '41898282' }}
         run: |
-          git config --global user.name "GitHub Actions Bot"
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config --global user.name "${APP_SLUG}"
+          git config --global user.email "${APP_USER_ID}+${APP_SLUG}[bot]@users.noreply.github.com"
 
           # We need the metadata to point to the right application for the release commit
           set -x
@@ -756,12 +765,12 @@ jobs:
           ls -l uploads/${PKG_FILE_PRETTY}
 
       - name: App Token Generate
-        uses: actions/create-github-app-token@21cfef2b496dd8ef5b904c159339626a10ad380e # v1.11.6
-        if: ${{ contains(matrix.releaseTarget, 'github') && vars.RELEASER_APP_CLIENT_ID }}
+        uses: actions/create-github-app-token@21cfef2b496dd8ef5b904c159339626a10ad380e  # v1.11.6
+        if: ${{ contains(matrix.releaseTarget, 'github') && vars.BOT_CLIENT_ID }}
         id: app-token
         with:
-          app-id: ${{ vars.RELEASER_APP_CLIENT_ID }}
-          private-key: ${{ secrets.RELEASER_APP_PRIVATE_KEY }}
+          app-id: ${{ vars.BOT_CLIENT_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
 
       - name: Publish to GitHub Releases
         id: publish_gh
diff --git a/.github/workflows/uplift-merges.yml b/.github/workflows/uplift-merges.yml
@@ -11,28 +11,41 @@ on:
 permissions:
   contents: read
 
+environment: botmobile
+
 jobs:
   uplift:
     name: Uplift
     runs-on: ubuntu-latest
     permissions:
       pull-requests: write
-      contents: write
     steps:
+      - name: App token generate
+        uses: actions/create-github-app-token@21cfef2b496dd8ef5b904c159339626a10ad380e # v1.11.6
+        if: ${{ !inputs.dryRun && vars.BOT_CLIENT_ID }}
+        id: app-token
+        with:
+          app-id: ${{ vars.BOT_CLIENT_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
+          token: ${{ steps.app-token.outputs.token || github.token }}
 
       - name: Configure for push
         if: ${{ !inputs.dryRun }}
+        env:
+          APP_SLUG: ${{ steps.app-token.outputs.app-slug || 'github-actions'}}
+          APP_USER_ID: ${{ vars.BOT_USER_ID || '41898282' }}
         run: |
-          git config --global user.name "GitHub Actions Bot"
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config --global user.name "${APP_SLUG}"
+          git config --global user.email "${APP_USER_ID}+${APP_SLUG}[bot]@users.noreply.github.com"
 
       - name: Run uplift script
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
           DRYRUN: ${{ !inputs.dryRun && '--no-dry-run' || '' }}
           BRANCH: ${{ github.ref_name }}
           PUSH: ${{ !inputs.dryRun && '--push' || '' }}
diff --git a/scripts/ci/setup_release_automation b/scripts/ci/setup_release_automation
