workflows/vendor-gems: trial using GitHub App token

[Bo98]

Hard to test really prior to merging.

[Bo98]

Could also potentially remove the BrewTestBot commit signing and replace that with: https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification#signature-verification-for-bots. I believe that requires using the REST/GraphQL API to commit rather than git though, but we could have an action to do that.

Will have a think about it. First is seeing if this works anyway.

[MikeMcQuaid]

Could also potentially remove the BrewTestBot commit signing and replace that with: https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification#signature-verification-for-bots. I believe that requires using the REST/GraphQL API to commit rather than git though, but we could have an action to do that.

Seems like a nice idea! Less code (and secrets?) to maintain on our end.

[Bo98]

Certainly less secrets.

For code: yes and no a bit. There will probably need some new code to call any relevant APIs, but that would go into a common action, like the existing Homebrew/actions/git-try-push. But it would then reduce code in the workflows themselves (i.e. no more Homebrew/actions/setup-commit-signing, no git commit etc).

I'll try it out and demonstrate in Homebrew/actions.

[KingSkybax]

L