feat/CONN-1273-release-stubs: release stubs mint their dispatch token from the GitHub App

- bank_feeds_release.yaml - guard + App token mint (scoped to the codegen repo) before the dispatch
- lending_release.yaml - guard + App token mint (scoped to the codegen repo) before the dispatch
- platform_release.yaml - guard + App token mint (scoped to the codegen repo) before the dispatch
- sync_for_expenses_release.yaml - guard + App token mint (scoped to the codegen repo) before the dispatch
- sync_for_payables_release.yaml - guard + App token mint (scoped to the codegen repo) before the dispatch

Author: mcollinscodat

.github/workflows/bank_feeds_release.yaml

@@ -2,7 +2,8 @@
 # Publishing no longer runs in this repo. The packaging checks, the PyPI upload,
 # the tag and the GitHub release all run centrally in publish-python.yml in
 # Codat SDK Codegen - no check has been dropped, they just moved. This stub
-# only forwards the release trigger there.
+# only forwards the release trigger there, authenticated with a short-lived
+# token minted from the GitHub App in the PUBLISH_TRIGGER_APP_* secrets.
 name: Release Bank Feeds library
 'on':
   push:
@@ -16,15 +17,28 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - name: Hand the release to the central publish pipeline
+      - name: Check the App secrets are set
+        env:
+          APP_ID_SET: ${{ secrets.PUBLISH_TRIGGER_APP_ID != '' }}
+          APP_KEY_SET: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY != '' }}
         run: |
-          if [ -z "${{ secrets.PUBLISH_TRIGGER_TOKEN }}" ]; then
-            echo "::error::PUBLISH_TRIGGER_TOKEN secret is not set - needed to send the publish-python repository dispatch to codat-internal/sdk-codegen"
+          if [ "$APP_ID_SET" != "true" ] || [ "$APP_KEY_SET" != "true" ]; then
+            echo "::error::PUBLISH_TRIGGER_APP_ID / PUBLISH_TRIGGER_APP_PRIVATE_KEY secrets are not set - needed to mint the token that sends the publish-python repository dispatch to codat-internal/sdk-codegen"
             exit 1
           fi
+      - name: Mint a token from the GitHub App
+        id: app_token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.PUBLISH_TRIGGER_APP_ID }}
+          private-key: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY }}
+          owner: codat-internal
+          repositories: sdk-codegen
+      - name: Hand the release to the central publish pipeline
+        run: |
           curl --fail-with-body --silent --show-error -X POST \
             -H "Accept: application/vnd.github+json" \
-            -H "Authorization: Bearer ${{ secrets.PUBLISH_TRIGGER_TOKEN }}" \
+            -H "Authorization: Bearer ${{ steps.app_token.outputs.token }}" \
             https://api.github.com/repos/codat-internal/sdk-codegen/dispatches \
             -d '{"event_type": "publish-python", "client_payload": {"product": "bank-feeds", "sha": "${{ github.sha }}"}}'
           echo "publish-python dispatch sent to codat-internal/sdk-codegen for bank-feeds @ ${{ github.sha }}"

.github/workflows/lending_release.yaml

@@ -2,7 +2,8 @@
 # Publishing no longer runs in this repo. The packaging checks, the PyPI upload,
 # the tag and the GitHub release all run centrally in publish-python.yml in
 # Codat SDK Codegen - no check has been dropped, they just moved. This stub
-# only forwards the release trigger there.
+# only forwards the release trigger there, authenticated with a short-lived
+# token minted from the GitHub App in the PUBLISH_TRIGGER_APP_* secrets.
 name: Release Lending library
 'on':
   push:
@@ -16,15 +17,28 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - name: Hand the release to the central publish pipeline
+      - name: Check the App secrets are set
+        env:
+          APP_ID_SET: ${{ secrets.PUBLISH_TRIGGER_APP_ID != '' }}
+          APP_KEY_SET: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY != '' }}
         run: |
-          if [ -z "${{ secrets.PUBLISH_TRIGGER_TOKEN }}" ]; then
-            echo "::error::PUBLISH_TRIGGER_TOKEN secret is not set - needed to send the publish-python repository dispatch to codat-internal/sdk-codegen"
+          if [ "$APP_ID_SET" != "true" ] || [ "$APP_KEY_SET" != "true" ]; then
+            echo "::error::PUBLISH_TRIGGER_APP_ID / PUBLISH_TRIGGER_APP_PRIVATE_KEY secrets are not set - needed to mint the token that sends the publish-python repository dispatch to codat-internal/sdk-codegen"
             exit 1
           fi
+      - name: Mint a token from the GitHub App
+        id: app_token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.PUBLISH_TRIGGER_APP_ID }}
+          private-key: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY }}
+          owner: codat-internal
+          repositories: sdk-codegen
+      - name: Hand the release to the central publish pipeline
+        run: |
           curl --fail-with-body --silent --show-error -X POST \
             -H "Accept: application/vnd.github+json" \
-            -H "Authorization: Bearer ${{ secrets.PUBLISH_TRIGGER_TOKEN }}" \
+            -H "Authorization: Bearer ${{ steps.app_token.outputs.token }}" \
             https://api.github.com/repos/codat-internal/sdk-codegen/dispatches \
             -d '{"event_type": "publish-python", "client_payload": {"product": "lending", "sha": "${{ github.sha }}"}}'
           echo "publish-python dispatch sent to codat-internal/sdk-codegen for lending @ ${{ github.sha }}"

.github/workflows/platform_release.yaml

@@ -2,7 +2,8 @@
 # Publishing no longer runs in this repo. The packaging checks, the PyPI upload,
 # the tag and the GitHub release all run centrally in publish-python.yml in
 # Codat SDK Codegen - no check has been dropped, they just moved. This stub
-# only forwards the release trigger there.
+# only forwards the release trigger there, authenticated with a short-lived
+# token minted from the GitHub App in the PUBLISH_TRIGGER_APP_* secrets.
 name: Release Platform library
 'on':
   push:
@@ -16,15 +17,28 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - name: Hand the release to the central publish pipeline
+      - name: Check the App secrets are set
+        env:
+          APP_ID_SET: ${{ secrets.PUBLISH_TRIGGER_APP_ID != '' }}
+          APP_KEY_SET: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY != '' }}
         run: |
-          if [ -z "${{ secrets.PUBLISH_TRIGGER_TOKEN }}" ]; then
-            echo "::error::PUBLISH_TRIGGER_TOKEN secret is not set - needed to send the publish-python repository dispatch to codat-internal/sdk-codegen"
+          if [ "$APP_ID_SET" != "true" ] || [ "$APP_KEY_SET" != "true" ]; then
+            echo "::error::PUBLISH_TRIGGER_APP_ID / PUBLISH_TRIGGER_APP_PRIVATE_KEY secrets are not set - needed to mint the token that sends the publish-python repository dispatch to codat-internal/sdk-codegen"
             exit 1
           fi
+      - name: Mint a token from the GitHub App
+        id: app_token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.PUBLISH_TRIGGER_APP_ID }}
+          private-key: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY }}
+          owner: codat-internal
+          repositories: sdk-codegen
+      - name: Hand the release to the central publish pipeline
+        run: |
           curl --fail-with-body --silent --show-error -X POST \
             -H "Accept: application/vnd.github+json" \
-            -H "Authorization: Bearer ${{ secrets.PUBLISH_TRIGGER_TOKEN }}" \
+            -H "Authorization: Bearer ${{ steps.app_token.outputs.token }}" \
             https://api.github.com/repos/codat-internal/sdk-codegen/dispatches \
             -d '{"event_type": "publish-python", "client_payload": {"product": "platform", "sha": "${{ github.sha }}"}}'
           echo "publish-python dispatch sent to codat-internal/sdk-codegen for platform @ ${{ github.sha }}"

.github/workflows/sync_for_expenses_release.yaml

@@ -2,7 +2,8 @@
 # Publishing no longer runs in this repo. The packaging checks, the PyPI upload,
 # the tag and the GitHub release all run centrally in publish-python.yml in
 # Codat SDK Codegen - no check has been dropped, they just moved. This stub
-# only forwards the release trigger there.
+# only forwards the release trigger there, authenticated with a short-lived
+# token minted from the GitHub App in the PUBLISH_TRIGGER_APP_* secrets.
 name: Release Sync for Expenses library
 'on':
   push:
@@ -16,15 +17,28 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - name: Hand the release to the central publish pipeline
+      - name: Check the App secrets are set
+        env:
+          APP_ID_SET: ${{ secrets.PUBLISH_TRIGGER_APP_ID != '' }}
+          APP_KEY_SET: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY != '' }}
         run: |
-          if [ -z "${{ secrets.PUBLISH_TRIGGER_TOKEN }}" ]; then
-            echo "::error::PUBLISH_TRIGGER_TOKEN secret is not set - needed to send the publish-python repository dispatch to codat-internal/sdk-codegen"
+          if [ "$APP_ID_SET" != "true" ] || [ "$APP_KEY_SET" != "true" ]; then
+            echo "::error::PUBLISH_TRIGGER_APP_ID / PUBLISH_TRIGGER_APP_PRIVATE_KEY secrets are not set - needed to mint the token that sends the publish-python repository dispatch to codat-internal/sdk-codegen"
             exit 1
           fi
+      - name: Mint a token from the GitHub App
+        id: app_token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.PUBLISH_TRIGGER_APP_ID }}
+          private-key: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY }}
+          owner: codat-internal
+          repositories: sdk-codegen
+      - name: Hand the release to the central publish pipeline
+        run: |
           curl --fail-with-body --silent --show-error -X POST \
             -H "Accept: application/vnd.github+json" \
-            -H "Authorization: Bearer ${{ secrets.PUBLISH_TRIGGER_TOKEN }}" \
+            -H "Authorization: Bearer ${{ steps.app_token.outputs.token }}" \
             https://api.github.com/repos/codat-internal/sdk-codegen/dispatches \
             -d '{"event_type": "publish-python", "client_payload": {"product": "sync-for-expenses", "sha": "${{ github.sha }}"}}'
           echo "publish-python dispatch sent to codat-internal/sdk-codegen for sync-for-expenses @ ${{ github.sha }}"

.github/workflows/sync_for_payables_release.yaml

@@ -2,7 +2,8 @@
 # Publishing no longer runs in this repo. The packaging checks, the PyPI upload,
 # the tag and the GitHub release all run centrally in publish-python.yml in
 # Codat SDK Codegen - no check has been dropped, they just moved. This stub
-# only forwards the release trigger there.
+# only forwards the release trigger there, authenticated with a short-lived
+# token minted from the GitHub App in the PUBLISH_TRIGGER_APP_* secrets.
 name: Release Sync for Payables library
 'on':
   push:
@@ -16,15 +17,28 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - name: Hand the release to the central publish pipeline
+      - name: Check the App secrets are set
+        env:
+          APP_ID_SET: ${{ secrets.PUBLISH_TRIGGER_APP_ID != '' }}
+          APP_KEY_SET: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY != '' }}
         run: |
-          if [ -z "${{ secrets.PUBLISH_TRIGGER_TOKEN }}" ]; then
-            echo "::error::PUBLISH_TRIGGER_TOKEN secret is not set - needed to send the publish-python repository dispatch to codat-internal/sdk-codegen"
+          if [ "$APP_ID_SET" != "true" ] || [ "$APP_KEY_SET" != "true" ]; then
+            echo "::error::PUBLISH_TRIGGER_APP_ID / PUBLISH_TRIGGER_APP_PRIVATE_KEY secrets are not set - needed to mint the token that sends the publish-python repository dispatch to codat-internal/sdk-codegen"
             exit 1
           fi
+      - name: Mint a token from the GitHub App
+        id: app_token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.PUBLISH_TRIGGER_APP_ID }}
+          private-key: ${{ secrets.PUBLISH_TRIGGER_APP_PRIVATE_KEY }}
+          owner: codat-internal
+          repositories: sdk-codegen
+      - name: Hand the release to the central publish pipeline
+        run: |
           curl --fail-with-body --silent --show-error -X POST \
             -H "Accept: application/vnd.github+json" \
-            -H "Authorization: Bearer ${{ secrets.PUBLISH_TRIGGER_TOKEN }}" \
+            -H "Authorization: Bearer ${{ steps.app_token.outputs.token }}" \
             https://api.github.com/repos/codat-internal/sdk-codegen/dispatches \
             -d '{"event_type": "publish-python", "client_payload": {"product": "sync-for-payables", "sha": "${{ github.sha }}"}}'
           echo "publish-python dispatch sent to codat-internal/sdk-codegen for sync-for-payables @ ${{ github.sha }}"