refactor(ci): migrate tibdex/github-app-token to actions/create-github-app-token (#4072)

.github/workflows/automatic-approval.yml

@@ -3,6 +3,8 @@ on:
   pull_request:
     types: [opened, synchronize]
 
+permissions: {}
+
 jobs:
   approve-automatic-prs:
     runs-on: ubuntu-latest
@@ -12,10 +14,12 @@ jobs:
         uses: actions/checkout@v5
       - name: Obtain token
         id: obtainToken
-        uses: tibdex/github-app-token@v2
+        uses: actions/create-github-app-token@v2
         with:
-          private_key: ${{ secrets.RENOVATE_APPROVE_PRIVATE_KEY }}
-          app_id: ${{ secrets.RENOVATE_APPROVE_APP_ID }}
+          private-key: ${{ secrets.RENOVATE_APPROVE_PRIVATE_KEY }}
+          app-id: ${{ secrets.RENOVATE_APPROVE_APP_ID }}
+          permission-pull-requests: write # required to approve pull request
+
       - name: Install GitHub CLI
         run: sudo apt-get install -y gh
       - name: Approve automatic PRs

.github/workflows/crowdin-schedule-download.yml

@@ -5,6 +5,9 @@ on:
   schedule:
     - cron: "0 0 * * *" # every day at midnight
 
+permissions:
+  contents: read # required for code checkout
+
 jobs:
   download-crowdin-translations:
     runs-on: ubuntu-latest
@@ -15,10 +18,12 @@ jobs:
 
       - name: Obtain token
         id: obtainToken
-        uses: tibdex/github-app-token@v2
+        uses: actions/create-github-app-token@v2
         with:
-          private_key: ${{ secrets.CROWDIN_APP_PRIVATE_KEY }}
-          app_id: ${{ secrets.CROWDIN_APP_ID }}
+          private-key: ${{ secrets.CROWDIN_APP_PRIVATE_KEY }}
+          app-id: ${{ secrets.CROWDIN_APP_ID }}
+          permission-contents: write # required to commit to crowdin branch
+          permission-pull-requests: write # required to create pull request
 
       - name: Download Crowdin translations
         id: crowdin-download

.github/workflows/deployment-docker-image.yml

@@ -49,10 +49,12 @@ jobs:
       - name: Obtain token
         if: env.SKIP_RELEASE == 'false'
         id: obtainToken
-        uses: tibdex/github-app-token@v2
+        uses: actions/create-github-app-token@v2
         with:
-          private_key: ${{ secrets.RENOVATE_MERGE_PRIVATE_KEY }}
-          app_id: ${{ secrets.RENOVATE_MERGE_APP_ID }}
+          private-key: ${{ secrets.RENOVATE_MERGE_PRIVATE_KEY }}
+          app-id: ${{ secrets.RENOVATE_MERGE_APP_ID }}
+          permission-contents: write # required to commit package.json & changelog changes, merge them to dev and publish the release
+
       - uses: actions/checkout@v5
         if: env.SKIP_RELEASE == 'false'
         with:

.github/workflows/deployment-weekly-release.yml

@@ -49,10 +49,11 @@ jobs:
           args: "Created a release PR ${{ steps.create-pull-request.outputs.url }} for version ${{ steps.semver.outputs.next }} (new behaviour: ${{ steps.semver.outputs.bump }})"
       - name: Obtain token
         id: obtainApprovalToken
-        uses: tibdex/github-app-token@v2
+        uses: actions/create-github-app-token@v2
         with:
-          private_key: ${{ secrets.RENOVATE_APPROVE_PRIVATE_KEY }}
-          app_id: ${{ secrets.RENOVATE_APPROVE_APP_ID }}
+          private-key: ${{ secrets.RENOVATE_APPROVE_PRIVATE_KEY }}
+          app-id: ${{ secrets.RENOVATE_APPROVE_APP_ID }}
+          permission-pull-requests: write
       - name: Approve PR
         env:
           GITHUB_TOKEN: ${{ steps.obtainApprovalToken.outputs.token }}
@@ -60,10 +61,12 @@ jobs:
           gh pr review --approve --body "Automatically approved by GitHub Action"
       - name: Obtain token
         id: obtainMergeToken
-        uses: tibdex/github-app-token@v2
+        uses: actions/create-github-app-token@v2
         with:
-          private_key: ${{ secrets.RENOVATE_MERGE_PRIVATE_KEY }}
-          app_id: ${{ secrets.RENOVATE_MERGE_APP_ID }}
+          private-key: ${{ secrets.RENOVATE_MERGE_PRIVATE_KEY }}
+          app-id: ${{ secrets.RENOVATE_MERGE_APP_ID }}
+          permission-contents: write # write to main branch (due to merge)
+          permission-pull-requests: write # merge pull request
       - id: automerge
         if: ${{ steps.semver.outputs.bump != 'major' }}
         name: automerge

.github/workflows/on-release.yml

@@ -11,12 +11,14 @@ jobs:
     steps:
       - name: Obtain token
         id: obtainToken
-        uses: tibdex/github-app-token@v2
+        uses: actions/create-github-app-token@v2
         with:
-          private_key: ${{ secrets.HOMARR_DOCS_RELEASE_APP_PRIVATE_KEY }}
-          app_id: ${{ vars.HOMARR_DOCS_RELEASE_APP_ID }}
-          installation_retrieval_mode: repository
-          installation_retrieval_payload: homarr-labs/documentation
+          private-key: ${{ secrets.HOMARR_DOCS_RELEASE_APP_PRIVATE_KEY }}
+          app-id: ${{ vars.HOMARR_DOCS_RELEASE_APP_ID }}
+          owner: homarr-labs
+          repositories: |
+            documentation
+          permission-contents: write # required to dispatch repository workflow
       - name: Trigger documentation release
         env:
           GITHUB_TOKEN: ${{ steps.obtainToken.outputs.token }}
@@ -40,10 +42,12 @@ jobs:
     steps:
       - name: Obtain token
         id: obtainToken
-        uses: tibdex/github-app-token@v2
+        uses: actions/create-github-app-token@v2
         with:
-          private_key: ${{ secrets.RENOVATE_MERGE_PRIVATE_KEY }}
-          app_id: ${{ secrets.RENOVATE_MERGE_APP_ID }}
+          private-key: ${{ secrets.RENOVATE_MERGE_PRIVATE_KEY }}
+          app-id: ${{ secrets.RENOVATE_MERGE_APP_ID }}
+          permission-contents: write # required to commit to branch
+          permission-pull-requests: write # required to create pr & enable automerge
       - name: Checkout code
         uses: actions/checkout@v5
         with:

.github/workflows/update-contributors.yml

@@ -9,9 +9,6 @@ env:
   GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
   CROWDIN_TOKEN: "${{ secrets.CROWDIN_UPDATE_CONTRIBUTORS_TOKEN }}"
 
-permissions:
-  contents: write
-
 jobs:
   update-contributors:
     runs-on: ubuntu-latest
@@ -21,10 +18,12 @@ jobs:
     steps:
       - name: Obtain token
         id: obtainToken
-        uses: tibdex/github-app-token@v2
+        uses: actions/create-github-app-token@v2
         with:
-          private_key: ${{ secrets.HOMARR_UPDATE_CONTRIBUTORS_PRIVATE_KEY }}
-          app_id: ${{ vars.HOMARR_UPDATE_CONTRIBUTORS_APP_ID }}
+          private-key: ${{ secrets.HOMARR_UPDATE_CONTRIBUTORS_PRIVATE_KEY }}
+          app-id: ${{ vars.HOMARR_UPDATE_CONTRIBUTORS_APP_ID }}
+          permission-contents: write # required to commit to branch
+          permission-pull-requests: write # required to create pr & enable automerge
 
       - name: Checkout repository
         uses: actions/checkout@v5

.github/workflows/update-integration-list.yml

@@ -1,7 +1,7 @@
 name: Update integration list
 
 on:
-  workflow_dispatch: { }
+  workflow_dispatch: {}
   push:
     paths:
       - packages/definitions/src/integration.ts
@@ -20,10 +20,12 @@ jobs:
     steps:
       - name: Obtain token
         id: obtainToken
-        uses: tibdex/github-app-token@v2
+        uses: actions/create-github-app-token@v2
         with:
-          private_key: ${{ secrets.HOMARR_UPDATE_CONTRIBUTORS_PRIVATE_KEY }}
-          app_id: ${{ vars.HOMARR_UPDATE_CONTRIBUTORS_APP_ID }}
+          private-key: ${{ secrets.HOMARR_UPDATE_CONTRIBUTORS_PRIVATE_KEY }}
+          app-id: ${{ vars.HOMARR_UPDATE_CONTRIBUTORS_APP_ID }}
+          permission-contents: write # required to commit to branch
+          permission-pull-requests: write # required to create pr & enable automerge
       - name: Checkout code
         uses: actions/checkout@v5
         env:
@@ -59,4 +61,4 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ steps.obtainToken.outputs.token }}
         run: |
-          gh pr merge ${{steps.create-pull-request.outputs.pull-request-number}} --auto --squash
+          gh pr merge ${{steps.create-pull-request.outputs.pull-request-number}} --auto --squash