ci(workflows): replace dispatch PAT with GitHub App tokens

.github/workflows/build.yml

@@ -275,10 +275,20 @@ jobs:
             echo "subdomain=dev" >> $GITHUB_OUTPUT
           fi
 
+      - name: Create tibiadata-argocd-app-of-apps dispatch token
+        id: app_token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          client-id: ${{ vars.TIBIADATA_CI_CLIENT_ID }}
+          private-key: ${{ secrets.TIBIADATA_CI_PRIVATE_KEY }}
+          owner: tibiadata
+          repositories: tibiadata-argocd-app-of-apps
+          permission-contents: write
+
       - name: Trigger workflow in tibiadata-argocd-app-of-apps repo
         uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 #v4.0.1
         with:
-          token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          token: ${{ steps.app_token.outputs.token }}
           repository: tibiadata/tibiadata-argocd-app-of-apps
           event-type: bump-tibiadata-api-go-image-sha
           client-payload: |-
@@ -297,10 +307,20 @@ jobs:
       - manifest
 
     steps:
+      - name: Create tibiadata-helm-charts dispatch token
+        id: app_token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          client-id: ${{ vars.TIBIADATA_CI_CLIENT_ID }}
+          private-key: ${{ secrets.TIBIADATA_CI_PRIVATE_KEY }}
+          owner: tibiadata
+          repositories: tibiadata-helm-charts
+          permission-contents: write
+
       - name: Trigger workflow in tibiadata-helm-charts repo
         uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 #v4.0.1
         with:
-          token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          token: ${{ steps.app_token.outputs.token }}
           repository: tibiadata/tibiadata-helm-charts
           event-type: bump-helm-chart-release
           client-payload: |-

.github/workflows/documentation.yml

@@ -36,10 +36,20 @@ jobs:
           file: docs/swagger.json
           tag: ${{ github.ref }}
 
+      - name: Create tibiadata-api-docs dispatch token
+        id: app_token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          client-id: ${{ vars.TIBIADATA_CI_CLIENT_ID }}
+          private-key: ${{ secrets.TIBIADATA_CI_PRIVATE_KEY }}
+          owner: tibiadata
+          repositories: tibiadata-api-docs
+          permission-contents: write
+
       - name: Trigger workflow in tibiadata-api-docs repo
         uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 #v4.0.1
         with:
-          token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          token: ${{ steps.app_token.outputs.token }}
           repository: tibiadata/tibiadata-api-docs
           event-type: tibiadata-api-docs-release-update
           client-payload: '{"ref": "${{ github.ref }}", "sha": "${{ github.sha }}", "tag_name": "${{ github.event.release.tag_name }}"}'

README.md

@@ -25,6 +25,7 @@ Documentation of API endpoints can be found on [docs.tibiadata.com](https://docs
   - [Available endpoints](#available-endpoints)
   - [Deprecated endpoints](#deprecated-endpoints)
   - [Restricted endpoints](#restricted-endpoints)
+- [CI authentication](#ci-authentication)
 - [General information](#general-information)
 - [Credits](#credits)
 
@@ -228,6 +229,19 @@ The data returned by the HTML and JSON collector can differ, which may lead to d
 
 - Account achievements on the HTML page do not reflect the actual achievements grade as correctly shown by the JSON collector.
 
+## CI authentication
+
+The build and documentation workflows use the `tibiadata-ci` GitHub App to send
+cross-repository `repository_dispatch` events. Organization Actions variable
+`TIBIADATA_CI_CLIENT_ID` and secret `TIBIADATA_CI_PRIVATE_KEY` must be available to
+this repository. The app must be installed on `tibiadata-api-docs`,
+`tibiadata-argocd-app-of-apps`, and `tibiadata-helm-charts` with **Contents: write**
+permission.
+
+Each dispatch creates a short-lived installation token restricted to its
+destination repository and **Contents: write**. The token is revoked at the end
+of the job. Other operations continue to use the workflow's `GITHUB_TOKEN`.
+
 ## General information
 
 Tibia is a registered trademark of [CipSoft GmbH](https://www.cipsoft.com/en/). Tibia and all products related to Tibia are copyright by [CipSoft GmbH](https://www.cipsoft.com/en/).