try app-auth

.github/workflows/cron.yml

@@ -10,3 +10,6 @@ jobs:
 
     steps:
       - uses: backstage/actions/[email protected]
+        with:
+          app-id: ${{ secrets.BACKSTAGE_GOALIE_APPLICATION_ID }}
+          private-key: ${{ secrets.BACKSTAGE_GOALIE_PRIVATE_KEY }}

cron/action.yml

@@ -1,10 +1,20 @@
 name: Backstage Cron
 description: Repository operations on a schedule
 inputs:
-  github-token:
-    description: The GitHub token used to create an authenticated client
-    default: ${{ github.token }}
-    required: false
+  # github-token:
+  #   description: The GitHub token used to create an authenticated client
+  #   default: ${{ github.token }}
+  #   required: false
+  app-id:
+    description: The Application ID of the GitHub App to use for authentication
+    required: true
+  private-key:
+    description: The Private Key of the GitHub App to use for authentication
+    required: true
+  # organization:
+  #   description: The GitHub token used to create an authenticated client
+  #   default: ${{ github.token }}
+  #   required: true
 outputs: {}
 runs:
   using: node16

cron/index.ts

@@ -3,11 +3,18 @@ import * as github from '@actions/github';
 import { verifyDCO } from './verifyDCO';
 import { mergeRenovatePRs } from './mergeRenovatePRs';
 import { mkLog } from '../lib/mkLog';
+import {
+  getApplicationToken,
+  readGetApplicationTokenOptions,
+} from '../lib/getApplicationToken';
 
 async function main() {
   core.info(`Running cron!`);
-  const token = core.getInput('github-token', { required: true });
-  const client = github.getOctokit(token);
+
+  const client = getApplicationToken(readGetApplicationTokenOptions());
+
+  // const token = core.getInput('github-token', { required: true });
+  // const client = github.getOctokit(token);
   const repoInfo = github.context.repo;
 
   await Promise.all([

lib/getApplicationToken.ts

@@ -0,0 +1,30 @@
+import * as core from '@actions/core';
+import * as github from '@actions/github';
+import { createAppAuth } from '@octokit/auth-app';
+
+interface Options {
+  appId: string;
+  privateKey: string;
+  // organization: string;
+}
+
+export function readGetApplicationTokenOptions(): Options {
+  return {
+    appId: core.getInput('app-id', { required: true }),
+    privateKey: core.getInput('private-key', { required: true }),
+    // organization: core.getInput('organization', { required: true }),
+  };
+}
+
+export function getApplicationToken(options: Options) {
+  const { appId, privateKey } = options;
+
+  const client = github.getOctokit('', {
+    authStrategy: createAppAuth,
+    auth: {
+      appId,
+      privateKey,
+    },
+  });
+  return client;
+}

package.json

@@ -13,6 +13,7 @@
   "dependencies": {
     "@actions/core": "^1.9.0",
     "@actions/github": "^5.0.3",
+    "@octokit/auth-app": "^3.6.1",
     "ts-node": "^10.8.1",
     "typescript": "^4.7.4"
   },