From 3d56d8cd497965ad73aa1be1143a3856bbac01be Mon Sep 17 00:00:00 2001 From: Safia Abdalla Date: Sat, 24 Oct 2026 00:50:54 -0700 Subject: [PATCH 1/2] ci: mint GitHub App tokens instead of warpmachineuser PATs Replace CHANNEL_VERSIONS_REPOSITORY_DISPATCH_TOKEN and DOCS_REPOSITORY_DISPATCH_TOKEN with short-lived installation tokens scoped to the dispatch target, and run the docs settings dispatch only in warp-internal. Co-Authored-By: Warp --- .github/workflows/cut_new_release_candidate.yml | 11 ++++++++++- .github/workflows/cut_new_releases.yml | 11 ++++++++++- .../workflows/notify-docs-settings-changed.yml | 15 ++++++++++++++- 3 files changed, 34 insertions(+), 3 deletions(-) diff --git a/.github/workflows/cut_new_release_candidate.yml b/.github/workflows/cut_new_release_candidate.yml index 5b73d170e9b..4ca9559c60b 100644 --- a/.github/workflows/cut_new_release_candidate.yml +++ b/.github/workflows/cut_new_release_candidate.yml @@ -47,10 +47,19 @@ jobs: - create_release_candidate runs-on: ubuntu-latest steps: + - name: Mint channel-versions token + id: app_token + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 + with: + client-id: ${{ vars.WARP_WORKFLOWS_APP_CLIENT_ID }} + private-key: ${{ secrets.WARP_WORKFLOWS_APP_PRIVATE_KEY }} + owner: warpdotdev + repositories: channel-versions + permission-contents: write - name: Invoke update workflow in channel-versions repository uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1 with: repository: warpdotdev/channel-versions - token: ${{ secrets.CHANNEL_VERSIONS_REPOSITORY_DISPATCH_TOKEN }} + token: ${{ steps.app_token.outputs.token }} event-type: update-channel-versions diff --git a/.github/workflows/cut_new_releases.yml b/.github/workflows/cut_new_releases.yml index 9f5299f3fb9..2bc8bbd28a6 100644 --- a/.github/workflows/cut_new_releases.yml +++ b/.github/workflows/cut_new_releases.yml @@ -88,9 +88,18 @@ jobs: - create_release runs-on: ubuntu-latest steps: + - name: Mint channel-versions token + id: app_token + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 + with: + client-id: ${{ vars.WARP_WORKFLOWS_APP_CLIENT_ID }} + private-key: ${{ secrets.WARP_WORKFLOWS_APP_PRIVATE_KEY }} + owner: warpdotdev + repositories: channel-versions + permission-contents: write - name: Invoke update workflow in channel-versions repository uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1 with: repository: warpdotdev/channel-versions - token: ${{ secrets.CHANNEL_VERSIONS_REPOSITORY_DISPATCH_TOKEN }} + token: ${{ steps.app_token.outputs.token }} event-type: update-channel-versions diff --git a/.github/workflows/notify-docs-settings-changed.yml b/.github/workflows/notify-docs-settings-changed.yml index 8e64f28be6e..c86185f2bb7 100644 --- a/.github/workflows/notify-docs-settings-changed.yml +++ b/.github/workflows/notify-docs-settings-changed.yml @@ -2,6 +2,8 @@ name: Notify docs of Settings UI changes # Fires when any Settings view source file is merged to master, signalling # that valid_paths.json in warpdotdev/docs may need to be refreshed. +# The dispatch runs only in warp-internal, which can read the app private key; +# the synced copy in public warp skips it. # # If this job fails: # 1. GitHub will email the commit author automatically. @@ -23,14 +25,25 @@ permissions: {} jobs: dispatch: name: Dispatch settings-ui-changed to docs + if: github.repository == 'warpdotdev/warp-internal' runs-on: ubuntu-latest steps: + - name: Mint docs token + id: app_token + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 + with: + client-id: ${{ vars.WARP_WORKFLOWS_APP_CLIENT_ID }} + private-key: ${{ secrets.WARP_WORKFLOWS_APP_PRIVATE_KEY }} + owner: warpdotdev + repositories: docs + permission-contents: write + - name: Send repository_dispatch to warpdotdev/docs id: dispatch uses: peter-evans/repository-dispatch@v4 with: repository: warpdotdev/docs - token: ${{ secrets.DOCS_REPOSITORY_DISPATCH_TOKEN }} + token: ${{ steps.app_token.outputs.token }} event-type: settings-ui-changed client-payload: | { From 67e57fbbd60faa3e2992670e592a24cde8255e11 Mon Sep 17 00:00:00 2001 From: harryalbert Date: Mon, 26 Oct 2026 19:50:05 -0400 Subject: [PATCH 2/2] Mint CI tokens with Octo STS instead of GitHub App private keys Co-Authored-By: Warp --- .github/workflows/cut_new_release_candidate.yml | 11 +++++------ .github/workflows/cut_new_releases.yml | 11 +++++------ .github/workflows/notify-docs-settings-changed.yml | 14 ++++++-------- 3 files changed, 16 insertions(+), 20 deletions(-) diff --git a/.github/workflows/cut_new_release_candidate.yml b/.github/workflows/cut_new_release_candidate.yml index 4ca9559c60b..d7616e35d51 100644 --- a/.github/workflows/cut_new_release_candidate.yml +++ b/.github/workflows/cut_new_release_candidate.yml @@ -46,16 +46,15 @@ jobs: needs: - create_release_candidate runs-on: ubuntu-latest + permissions: + id-token: write # octo-sts/action exchanges the job's OIDC token for a scoped GitHub token steps: - name: Mint channel-versions token id: app_token - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 + uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1 with: - client-id: ${{ vars.WARP_WORKFLOWS_APP_CLIENT_ID }} - private-key: ${{ secrets.WARP_WORKFLOWS_APP_PRIVATE_KEY }} - owner: warpdotdev - repositories: channel-versions - permission-contents: write + scope: warpdotdev/channel-versions + identity: warp-internal-dispatch - name: Invoke update workflow in channel-versions repository uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1 with: diff --git a/.github/workflows/cut_new_releases.yml b/.github/workflows/cut_new_releases.yml index 2bc8bbd28a6..6e720e69a9a 100644 --- a/.github/workflows/cut_new_releases.yml +++ b/.github/workflows/cut_new_releases.yml @@ -87,16 +87,15 @@ jobs: needs: - create_release runs-on: ubuntu-latest + permissions: + id-token: write # octo-sts/action exchanges the job's OIDC token for a scoped GitHub token steps: - name: Mint channel-versions token id: app_token - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 + uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1 with: - client-id: ${{ vars.WARP_WORKFLOWS_APP_CLIENT_ID }} - private-key: ${{ secrets.WARP_WORKFLOWS_APP_PRIVATE_KEY }} - owner: warpdotdev - repositories: channel-versions - permission-contents: write + scope: warpdotdev/channel-versions + identity: warp-internal-dispatch - name: Invoke update workflow in channel-versions repository uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1 with: diff --git a/.github/workflows/notify-docs-settings-changed.yml b/.github/workflows/notify-docs-settings-changed.yml index c86185f2bb7..99a757ea8bf 100644 --- a/.github/workflows/notify-docs-settings-changed.yml +++ b/.github/workflows/notify-docs-settings-changed.yml @@ -2,8 +2,7 @@ name: Notify docs of Settings UI changes # Fires when any Settings view source file is merged to master, signalling # that valid_paths.json in warpdotdev/docs may need to be refreshed. -# The dispatch runs only in warp-internal, which can read the app private key; -# the synced copy in public warp skips it. +# The dispatch runs only in warp-internal; the synced copy in public warp skips it. # # If this job fails: # 1. GitHub will email the commit author automatically. @@ -27,16 +26,15 @@ jobs: name: Dispatch settings-ui-changed to docs if: github.repository == 'warpdotdev/warp-internal' runs-on: ubuntu-latest + permissions: + id-token: write # octo-sts/action exchanges the job's OIDC token for a scoped GitHub token steps: - name: Mint docs token id: app_token - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 + uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1 with: - client-id: ${{ vars.WARP_WORKFLOWS_APP_CLIENT_ID }} - private-key: ${{ secrets.WARP_WORKFLOWS_APP_PRIVATE_KEY }} - owner: warpdotdev - repositories: docs - permission-contents: write + scope: warpdotdev/docs + identity: warp-internal-dispatch - name: Send repository_dispatch to warpdotdev/docs id: dispatch