From 4516e4b7b2636829f4db188807977235db13dcf0 Mon Sep 17 00:00:00 2001 From: tobiasehlert Date: Mon, 19 Oct 2026 23:55:51 +0200 Subject: [PATCH 1/2] ci(workflows): replace dispatch PAT with GitHub App tokens Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/build.yml | 24 ++++++++++++++++++++++-- .github/workflows/documentation.yml | 12 +++++++++++- README.md | 14 ++++++++++++++ 3 files changed, 47 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 956a398a..7a1fb9ec 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -275,10 +275,20 @@ jobs: echo "subdomain=dev" >> $GITHUB_OUTPUT fi + - name: Create tibiadata-argocd-app-of-apps dispatch token + id: dispatch_token + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 #v3.3.0 + with: + client-id: ${{ vars.TIBIADATA_CI_CLIENT_ID }} + private-key: ${{ secrets.TIBIADATA_CI_PRIVATE_KEY }} + owner: tibiadata + repositories: tibiadata-argocd-app-of-apps + permission-contents: write + - name: Trigger workflow in tibiadata-argocd-app-of-apps repo uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 #v4.0.1 with: - token: ${{ secrets.REPO_ACCESS_TOKEN }} + token: ${{ steps.dispatch_token.outputs.token }} repository: tibiadata/tibiadata-argocd-app-of-apps event-type: bump-tibiadata-api-go-image-sha client-payload: |- @@ -297,10 +307,20 @@ jobs: - manifest steps: + - name: Create tibiadata-helm-charts dispatch token + id: dispatch_token + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 #v3.3.0 + with: + client-id: ${{ vars.TIBIADATA_CI_CLIENT_ID }} + private-key: ${{ secrets.TIBIADATA_CI_PRIVATE_KEY }} + owner: tibiadata + repositories: tibiadata-helm-charts + permission-contents: write + - name: Trigger workflow in tibiadata-helm-charts repo uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 #v4.0.1 with: - token: ${{ secrets.REPO_ACCESS_TOKEN }} + token: ${{ steps.dispatch_token.outputs.token }} repository: tibiadata/tibiadata-helm-charts event-type: bump-helm-chart-release client-payload: |- diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml index 73aa5756..0f5733a3 100644 --- a/.github/workflows/documentation.yml +++ b/.github/workflows/documentation.yml @@ -36,10 +36,20 @@ jobs: file: docs/swagger.json tag: ${{ github.ref }} + - name: Create tibiadata-api-docs dispatch token + id: dispatch_token + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 #v3.3.0 + with: + client-id: ${{ vars.TIBIADATA_CI_CLIENT_ID }} + private-key: ${{ secrets.TIBIADATA_CI_PRIVATE_KEY }} + owner: tibiadata + repositories: tibiadata-api-docs + permission-contents: write + - name: Trigger workflow in tibiadata-api-docs repo uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 #v4.0.1 with: - token: ${{ secrets.REPO_ACCESS_TOKEN }} + token: ${{ steps.dispatch_token.outputs.token }} repository: tibiadata/tibiadata-api-docs event-type: tibiadata-api-docs-release-update client-payload: '{"ref": "${{ github.ref }}", "sha": "${{ github.sha }}", "tag_name": "${{ github.event.release.tag_name }}"}' diff --git a/README.md b/README.md index b68ec463..5e9545ef 100644 --- a/README.md +++ b/README.md @@ -25,6 +25,7 @@ Documentation of API endpoints can be found on [docs.tibiadata.com](https://docs - [Available endpoints](#available-endpoints) - [Deprecated endpoints](#deprecated-endpoints) - [Restricted endpoints](#restricted-endpoints) +- [CI authentication](#ci-authentication) - [General information](#general-information) - [Credits](#credits) @@ -228,6 +229,19 @@ The data returned by the HTML and JSON collector can differ, which may lead to d - Account achievements on the HTML page do not reflect the actual achievements grade as correctly shown by the JSON collector. +## CI authentication + +The build and documentation workflows use the `tibiadata-ci` GitHub App to send +cross-repository `repository_dispatch` events. Organization Actions variable +`TIBIADATA_CI_CLIENT_ID` and secret `TIBIADATA_CI_PRIVATE_KEY` must be available to +this repository. The app must be installed on `tibiadata-api-docs`, +`tibiadata-argocd-app-of-apps`, and `tibiadata-helm-charts` with **Contents: write** +permission. + +Each dispatch creates a short-lived installation token restricted to its +destination repository and **Contents: write**. The token is revoked at the end +of the job. Other operations continue to use the workflow's `GITHUB_TOKEN`. + ## General information Tibia is a registered trademark of [CipSoft GmbH](https://www.cipsoft.com/en/). Tibia and all products related to Tibia are copyright by [CipSoft GmbH](https://www.cipsoft.com/en/). From 80a7f24683f23ce5d93af522efca1a5e84b17ae2 Mon Sep 17 00:00:00 2001 From: tobiasehlert Date: Tue, 20 Oct 2026 00:07:54 +0200 Subject: [PATCH 2/2] style(ci): normalize app token step IDs and pin comments Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/build.yml | 12 ++++++------ .github/workflows/documentation.yml | 6 +++--- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 7a1fb9ec..60af8780 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -276,8 +276,8 @@ jobs: fi - name: Create tibiadata-argocd-app-of-apps dispatch token - id: dispatch_token - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 #v3.3.0 + id: app_token + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 with: client-id: ${{ vars.TIBIADATA_CI_CLIENT_ID }} private-key: ${{ secrets.TIBIADATA_CI_PRIVATE_KEY }} @@ -288,7 +288,7 @@ jobs: - name: Trigger workflow in tibiadata-argocd-app-of-apps repo uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 #v4.0.1 with: - token: ${{ steps.dispatch_token.outputs.token }} + token: ${{ steps.app_token.outputs.token }} repository: tibiadata/tibiadata-argocd-app-of-apps event-type: bump-tibiadata-api-go-image-sha client-payload: |- @@ -308,8 +308,8 @@ jobs: steps: - name: Create tibiadata-helm-charts dispatch token - id: dispatch_token - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 #v3.3.0 + id: app_token + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 with: client-id: ${{ vars.TIBIADATA_CI_CLIENT_ID }} private-key: ${{ secrets.TIBIADATA_CI_PRIVATE_KEY }} @@ -320,7 +320,7 @@ jobs: - name: Trigger workflow in tibiadata-helm-charts repo uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 #v4.0.1 with: - token: ${{ steps.dispatch_token.outputs.token }} + token: ${{ steps.app_token.outputs.token }} repository: tibiadata/tibiadata-helm-charts event-type: bump-helm-chart-release client-payload: |- diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml index 0f5733a3..721f7c0d 100644 --- a/.github/workflows/documentation.yml +++ b/.github/workflows/documentation.yml @@ -37,8 +37,8 @@ jobs: tag: ${{ github.ref }} - name: Create tibiadata-api-docs dispatch token - id: dispatch_token - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 #v3.3.0 + id: app_token + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 with: client-id: ${{ vars.TIBIADATA_CI_CLIENT_ID }} private-key: ${{ secrets.TIBIADATA_CI_PRIVATE_KEY }} @@ -49,7 +49,7 @@ jobs: - name: Trigger workflow in tibiadata-api-docs repo uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 #v4.0.1 with: - token: ${{ steps.dispatch_token.outputs.token }} + token: ${{ steps.app_token.outputs.token }} repository: tibiadata/tibiadata-api-docs event-type: tibiadata-api-docs-release-update client-payload: '{"ref": "${{ github.ref }}", "sha": "${{ github.sha }}", "tag_name": "${{ github.event.release.tag_name }}"}'