From c7b16a1a6eb6d35d3be0218e110ebc84b49c1c27 Mon Sep 17 00:00:00 2001 From: Jeff Widman Date: Thu, 21 Mar 2024 01:25:29 -0700 Subject: [PATCH] Switch to offical GitHub action for managing app tokens (#9340) Improve security by switching to the official GitHub action for managing app tokens. More [details](https://github.com/tibdex/github-app-token/issues/99#issuecomment-1787602874). The default scope is limited to only this repo per the [docs](https://github.com/actions/create-github-app-token?tab=readme-ov-file#repositories): > If owner and repositories are empty, access will be scoped to only the current repository. --- .github/workflows/gems-bump-version.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/gems-bump-version.yml b/.github/workflows/gems-bump-version.yml index 0655755f39..df9c0fdc50 100644 --- a/.github/workflows/gems-bump-version.yml +++ b/.github/workflows/gems-bump-version.yml @@ -19,10 +19,10 @@ jobs: steps: - name: Generate token id: generate_token - uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0 + uses: actions/create-github-app-token@f2acddfb5195534d487896a656232b016a682f3c # v1.9.0 with: - app_id: ${{ secrets.DEPENDABOT_CORE_ACTION_AUTOMATION_APP_ID }} - private_key: ${{ secrets.DEPENDABOT_CORE_ACTION_AUTOMATION_PRIVATE_KEY }} + app-id: ${{ secrets.DEPENDABOT_CORE_ACTION_AUTOMATION_APP_ID }} + private-key: ${{ secrets.DEPENDABOT_CORE_ACTION_AUTOMATION_PRIVATE_KEY }} - uses: actions/checkout@v4 with: