Skip to content

Replace PAT with SDK Updater GitHub App #548

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cguldner merged 2 commits into from
Jul 17, 2026
+30 −2
Merged

Replace PAT with SDK Updater GitHub App #548

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
72fc944
Replace PAT with SDK Updater GitHub App for spec update workflow
cguldner Jul 17, 2026
7989a2e
disable automerge for now
cguldner Jul 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 30 additions & 2 deletions .github/workflows/spec_update.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,13 +4,34 @@ on:
repository_dispatch:
types: [spec_update]

permissions: # least privilege; PR creation uses the SPEC_UPDATE_TOKEN PAT
permissions:
id-token: write
contents: read

jobs:
Update:
runs-on: ubuntu-latest
steps:
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v6
with:
role-to-assume: arn:aws:iam::082972943155:role/oidc-github-dropbox-dropbox-sdk-python-repo
aws-region: us-west-2

- name: Fetch GitHub App credentials from Secrets Manager
uses: aws-actions/aws-secretsmanager-get-secrets@v3
with:
secret-ids: |
SDK_UPDATER,sdk-updater-github-app
parse-json-secrets: true

- name: Generate GitHub App installation token
id: app-token
uses: actions/create-github-app-token@v3
with:
client-id: ${{ env.SDK_UPDATER_CLIENT_ID }}
private-key: ${{ env.SDK_UPDATER_PRIVATE_KEY }}

- uses: actions/checkout@v7
- name: Setup Python environment
uses: actions/setup-python@v6
Expand Down Expand Up @@ -64,10 +85,11 @@ jobs:
pip install -r requirements.txt
python generate_base_client.py
- name: Create Pull Request
id: create-pr
uses: peter-evans/create-pull-request@v8
if: steps.git-diff-num.outputs.num-diff != 0
with:
token: ${{ secrets.SPEC_UPDATE_TOKEN }}
token: ${{ steps.app-token.outputs.token }}
commit-message: |
${{ steps.git-diff.outputs.commit}}
branch: ${{ steps.git-branch.outputs.branch }}
Expand All @@ -80,3 +102,9 @@ jobs:
owners
maintainers
draft: false

# - name: Enable Pull Request Automerge
# if: steps.create-pr.outputs.pull-request-number
# run: gh pr merge --merge --auto "${{ steps.create-pr.outputs.pull-request-number }}"
# env:
# GH_TOKEN: ${{ steps.app-token.outputs.token }}
Loading