@kungfu-tech/buildchain 2.4.11-alpha.1 → 2.4.11-alpha.2

package/actions/report-buildchain-issue/README.md

@@ -58,12 +58,20 @@ permissions:
   issues: write
 
 steps:
+  - uses: actions/create-github-app-token@v2
+    id: buildchain-issue-token
+    with:
+      app-id: ${{ secrets.BUILDCHAIN_ISSUE_APP_ID }}
+      private-key: ${{ secrets.BUILDCHAIN_ISSUE_APP_PRIVATE_KEY }}
+      owner: kungfu-systems
+      repositories: buildchain
+
   - uses: kungfu-systems/buildchain/actions/report-buildchain-issue@v2
     if: failure()
     with:
-      token: ${{ secrets.BUILDCHAIN_ISSUE_TOKEN || secrets.BUILDCHAIN_PROMOTION_TOKEN || github.token }}
+      token: ${{ steps.buildchain-issue-token.outputs.token || secrets.BUILDCHAIN_ISSUE_TOKEN || secrets.BUILDCHAIN_PROMOTION_TOKEN || github.token }}
       report-kind: workflow-friction
-      target-repository: ${{ github.repository }}
+      target-repository: kungfu-systems/buildchain
       repository: ${{ github.repository }}
       workflow: ${{ github.workflow }}
       run-id: ${{ github.run_id }}

package/docs/reusable-build-surface.md

@@ -391,7 +391,8 @@ jobs:
   promote:
     uses: kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v2
     secrets:
-      buildchain-issue-token: ${{ secrets.BUILDCHAIN_ISSUE_TOKEN }}
+      buildchain-issue-app-id: ${{ secrets.BUILDCHAIN_ISSUE_APP_ID }}
+      buildchain-issue-app-private-key: ${{ secrets.BUILDCHAIN_ISSUE_APP_PRIVATE_KEY }}
     with:
       channel: alpha
       target-ref: alpha/v22/v22.22
@@ -412,12 +413,15 @@ jobs:
       release-passport-product-name: Libnode
 ```
 
-`buildchain-issue-token` is optional but recommended for cross-repository
-consumers. It should be a GitHub App installation token or other scoped token
-with `issues: write` on `kungfu-systems/buildchain`. If omitted, the wrapper
-falls back to `BUILDCHAIN_PROMOTION_TOKEN` and then the consumer workflow's
-`github.token`; the last fallback can only report issues when it has write
-access to the target Buildchain repository.
+`buildchain-issue-app-id` and `buildchain-issue-app-private-key` are optional
+but recommended for cross-repository consumers. They should identify a GitHub
+App installation with `issues: write` on `kungfu-systems/buildchain`; the
+wrapper mints the installation token before calling
+`actions/report-buildchain-issue`. Consumers can also pass a pre-minted
+`buildchain-issue-token`. If both are omitted, the wrapper falls back to
+`BUILDCHAIN_ISSUE_TOKEN`, `BUILDCHAIN_PROMOTION_TOKEN`, and then the consumer
+workflow's `github.token`; the last fallback can only report issues when it has
+write access to the target Buildchain repository.
 
 `publish-required-artifacts-json` can still be passed explicitly for custom
 publish targets. For the default `publish-artifact-kind: npm` path, consumers do

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.4.11-alpha.1",
+  "version": "2.4.11-alpha.2",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",