From 72fc944d91627e8255f52aaf9286592850beebbb Mon Sep 17 00:00:00 2001 From: Cody Guldner Date: Fri, 17 Jul 2026 11:26:46 -0500 Subject: [PATCH 1/2] Replace PAT with SDK Updater GitHub App for spec update workflow Use AWS OIDC + Secrets Manager to mint GitHub App installation tokens instead of a classic PAT. Add automerge step for spec update PRs. Co-Authored-By: Claude Opus 4.6 --- .github/workflows/spec_update.yml | 32 +++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/.github/workflows/spec_update.yml b/.github/workflows/spec_update.yml index fc8efb4..0e8afbe 100644 --- a/.github/workflows/spec_update.yml +++ b/.github/workflows/spec_update.yml @@ -4,13 +4,34 @@ on: repository_dispatch: types: [spec_update] -permissions: # least privilege; PR creation uses the SPEC_UPDATE_TOKEN PAT +permissions: + id-token: write contents: read jobs: Update: runs-on: ubuntu-latest steps: + - name: Configure AWS credentials + uses: aws-actions/configure-aws-credentials@v6 + with: + role-to-assume: arn:aws:iam::082972943155:role/oidc-github-dropbox-dropbox-sdk-python-repo + aws-region: us-west-2 + + - name: Fetch GitHub App credentials from Secrets Manager + uses: aws-actions/aws-secretsmanager-get-secrets@v3 + with: + secret-ids: | + SDK_UPDATER,sdk-updater-github-app + parse-json-secrets: true + + - name: Generate GitHub App installation token + id: app-token + uses: actions/create-github-app-token@v3 + with: + client-id: ${{ env.SDK_UPDATER_CLIENT_ID }} + private-key: ${{ env.SDK_UPDATER_PRIVATE_KEY }} + - uses: actions/checkout@v7 - name: Setup Python environment uses: actions/setup-python@v6 @@ -64,10 +85,11 @@ jobs: pip install -r requirements.txt python generate_base_client.py - name: Create Pull Request + id: create-pr uses: peter-evans/create-pull-request@v8 if: steps.git-diff-num.outputs.num-diff != 0 with: - token: ${{ secrets.SPEC_UPDATE_TOKEN }} + token: ${{ steps.app-token.outputs.token }} commit-message: | ${{ steps.git-diff.outputs.commit}} branch: ${{ steps.git-branch.outputs.branch }} @@ -80,3 +102,9 @@ jobs: owners maintainers draft: false + + - name: Enable Pull Request Automerge + if: steps.create-pr.outputs.pull-request-number + run: gh pr merge --merge --auto "${{ steps.create-pr.outputs.pull-request-number }}" + env: + GH_TOKEN: ${{ steps.app-token.outputs.token }} From 7989a2ee16d0f15e599047e94bd7f11eb6bb7c46 Mon Sep 17 00:00:00 2001 From: Cody Guldner Date: Fri, 17 Jul 2026 13:25:35 -0500 Subject: [PATCH 2/2] disable automerge for now --- .github/workflows/spec_update.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/spec_update.yml b/.github/workflows/spec_update.yml index 0e8afbe..0309c06 100644 --- a/.github/workflows/spec_update.yml +++ b/.github/workflows/spec_update.yml @@ -103,8 +103,8 @@ jobs: maintainers draft: false - - name: Enable Pull Request Automerge - if: steps.create-pr.outputs.pull-request-number - run: gh pr merge --merge --auto "${{ steps.create-pr.outputs.pull-request-number }}" - env: - GH_TOKEN: ${{ steps.app-token.outputs.token }} + # - name: Enable Pull Request Automerge + # if: steps.create-pr.outputs.pull-request-number + # run: gh pr merge --merge --auto "${{ steps.create-pr.outputs.pull-request-number }}" + # env: + # GH_TOKEN: ${{ steps.app-token.outputs.token }}