build: do not persist token and use new fine-grained PAT for PR

--- type: pre_commit_static_analysis_report description: Results of running static analysis checks when committing changes. report: - task: lint_filenames status: passed - task: lint_editorconfig status: passed - task: lint_markdown status: na - task: lint_package_json status: na - task: lint_repl_help status: na - task: lint_javascript_src status: na - task: lint_javascript_cli status: na - task: lint_javascript_examples status: na - task: lint_javascript_tests status: na - task: lint_javascript_benchmarks status: na - task: lint_python status: na - task: lint_r status: na - task: lint_c_src status: na - task: lint_c_examples status: na - task: lint_c_benchmarks status: na - task: lint_c_tests_fixtures status: na - task: lint_shell status: na - task: lint_typescript_declarations status: na - task: lint_typescript_tests status: na - task: lint_license_headers status: passed --- --- type: pre_push_report description: Results of running various checks prior to pushing changes. report: - task: run_javascript_examples status: na - task: run_c_examples status: na - task: run_cpp_examples status: na - task: run_javascript_readme_examples status: na - task: run_c_benchmarks status: na - task: run_cpp_benchmarks status: na - task: run_fortran_benchmarks status: na - task: run_javascript_benchmarks status: na - task: run_julia_benchmarks status: na - task: run_python_benchmarks status: na - task: run_r_benchmarks status: na - task: run_javascript_tests status: na ---
stdlib-js · Jan 25, 2025 · 31224e1 · 31224e1
1 parent eddf827
commit 31224e1
Show file tree

Hide file tree

Showing 5 changed files with 20 additions and 5 deletions.
diff --git a/.github/workflows/update_cli_permissions.yml b/.github/workflows/update_cli_permissions.yml
@@ -64,6 +64,9 @@ jobs:
 
           # Specify whether to download Git-LFS files:
           lfs: false
+
+          # Avoid storing GitHub token in local Git configuration:
+          persist-credentials: false
         timeout-minutes: 10
 
       # Make CLI scripts executable:
@@ -102,7 +105,7 @@ jobs:
           signoff: true
           body: |
             This PR changes the permissions of project `cli` scripts to be executable.
-          token: ${{ secrets.PULL_REQUEST_TOKEN }}
+          token: ${{ secrets.STDLIB_BOT_FGPAT_PR_WRITE }}
           labels: |
             automated-pr
           team-reviewers: |

diff --git a/.github/workflows/update_contributors.yml b/.github/workflows/update_contributors.yml
@@ -67,6 +67,9 @@ jobs:
 
           # Specify whether to download Git-LFS files:
           lfs: false
+
+          # Avoid storing GitHub token in local Git configuration:
+          persist-credentials: false
         timeout-minutes: 10
 
       # Update the contributors list:
@@ -115,7 +118,7 @@ jobs:
           commit-message: 'docs: update list of contributors'
           committer: 'stdlib-bot <[email protected]>'
           signoff: true
-          token: ${{ secrets.PULL_REQUEST_TOKEN }}
+          token: ${{ secrets.STDLIB_BOT_FGPAT_PR_WRITE }}
           labels: |
             documentation
             automated-pr

diff --git a/.github/workflows/update_error_databases.yml b/.github/workflows/update_error_databases.yml
@@ -64,6 +64,9 @@ jobs:
 
           # Specify whether to download Git-LFS files:
           lfs: false
+
+          # Avoid storing GitHub token in local Git configuration:
+          persist-credentials: false
         timeout-minutes: 10
 
       # Install Node.js:
@@ -163,7 +166,7 @@ jobs:
           commit-message: 'feat: update error databases'
           committer: 'stdlib-bot <[email protected]>'
           signoff: true
-          token: ${{ secrets.PULL_REQUEST_TOKEN }}
+          token: ${{ secrets.STDLIB_BOT_FGPAT_PR_WRITE }}
           labels: |
             documentation
             automated-pr

diff --git a/.github/workflows/update_package_meta_data.yml b/.github/workflows/update_package_meta_data.yml
@@ -65,6 +65,9 @@ jobs:
 
           # Specify whether to download Git-LFS files:
           lfs: false
+
+          # Avoid storing GitHub token in local Git configuration:
+          persist-credentials: false
         timeout-minutes: 10
 
       # Install Node.js:
@@ -116,7 +119,7 @@ jobs:
           commit-message: 'chore: update package meta data'
           committer: 'stdlib-bot <[email protected]>'
           signoff: true
-          token: ${{ secrets.PULL_REQUEST_TOKEN }}
+          token: ${{ secrets.STDLIB_BOT_FGPAT_PR_WRITE }}
           labels: |
             automated-pr
           team-reviewers: |

diff --git a/.github/workflows/update_repl_docs.yml b/.github/workflows/update_repl_docs.yml
@@ -64,6 +64,9 @@ jobs:
 
           # Specify whether to download Git-LFS files:
           lfs: false
+
+          # Avoid storing GitHub token in local Git configuration:
+          persist-credentials: false
         timeout-minutes: 10
 
       # Install Node.js:
@@ -121,7 +124,7 @@ jobs:
           commit-message: 'docs: update REPL namespace documentation'
           committer: 'stdlib-bot <[email protected]>'
           signoff: true
-          token: ${{ secrets.PULL_REQUEST_TOKEN }}
+          token: ${{ secrets.STDLIB_BOT_FGPAT_PR_WRITE }}
           labels: |
             documentation
             automated-pr