From 39edd0b3b7873351718cc60a7bccb289918c6c8a Mon Sep 17 00:00:00 2001 From: Amy Galles <9685081+AmyLGalles@users.noreply.github.com> Date: Thu, 9 Apr 2026 11:13:48 -0700 Subject: [PATCH 1/6] temporary change to test bre-1670 --- .github/workflows/ephemeral-environment.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ephemeral-environment.yml b/.github/workflows/ephemeral-environment.yml index 456ca573cc74..09ff18e9544f 100644 --- a/.github/workflows/ephemeral-environment.yml +++ b/.github/workflows/ephemeral-environment.yml @@ -12,7 +12,7 @@ jobs: setup-ephemeral-environment: name: Setup Ephemeral Environment if: github.event.label.name == 'ephemeral-environment' - uses: bitwarden/gh-actions/.github/workflows/_ephemeral_environment_manager.yml@main + uses: bitwarden/gh-actions/.github/workflows/_ephemeral_environment_manager.yml@agalles/BRE-1670-2 with: project: server pull_request_number: ${{ github.event.number }} From 1925436b597eb806f4743fbd055f898154c9bd7e Mon Sep 17 00:00:00 2001 From: Amy Galles <9685081+AmyLGalles@users.noreply.github.com> Date: Thu, 9 Apr 2026 11:16:30 -0700 Subject: [PATCH 2/6] removing temporary change --- .github/workflows/ephemeral-environment.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ephemeral-environment.yml b/.github/workflows/ephemeral-environment.yml index 09ff18e9544f..456ca573cc74 100644 --- a/.github/workflows/ephemeral-environment.yml +++ b/.github/workflows/ephemeral-environment.yml @@ -12,7 +12,7 @@ jobs: setup-ephemeral-environment: name: Setup Ephemeral Environment if: github.event.label.name == 'ephemeral-environment' - uses: bitwarden/gh-actions/.github/workflows/_ephemeral_environment_manager.yml@agalles/BRE-1670-2 + uses: bitwarden/gh-actions/.github/workflows/_ephemeral_environment_manager.yml@main with: project: server pull_request_number: ${{ github.event.number }} From 80906007ebc25056fd9dedeb7a5ba83771d3da40 Mon Sep 17 00:00:00 2001 From: Amy Galles <9685081+AmyLGalles@users.noreply.github.com> Date: Thu, 9 Apr 2026 21:20:57 -0700 Subject: [PATCH 3/6] replace pat token with built in github token --- .github/workflows/_move_edd_db_scripts.yml | 35 +++------------------- 1 file changed, 4 insertions(+), 31 deletions(-) diff --git a/.github/workflows/_move_edd_db_scripts.yml b/.github/workflows/_move_edd_db_scripts.yml index 91d069da8db7..2151930b62ca 100644 --- a/.github/workflows/_move_edd_db_scripts.yml +++ b/.github/workflows/_move_edd_db_scripts.yml @@ -20,27 +20,10 @@ jobs: copy_edd_scripts: ${{ steps.check-script-existence.outputs.copy_edd_scripts }} steps: - - name: Log in to Azure - uses: bitwarden/gh-actions/azure-login@main - with: - subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - tenant_id: ${{ secrets.AZURE_TENANT_ID }} - client_id: ${{ secrets.AZURE_CLIENT_ID }} - - - name: Retrieve secrets - id: retrieve-secrets - uses: bitwarden/gh-actions/get-keyvault-secrets@main - with: - keyvault: "bitwarden-ci" - secrets: "github-pat-bitwarden-devops-bot-repo-scope" - - - name: Log out from Azure - uses: bitwarden/gh-actions/azure-logout@main - - name: Check out branch uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - token: ${{ steps.retrieve-secrets.outputs.github-pat-bitwarden-devops-bot-repo-scope }} + token: ${{ secrets.GITHUB_TOKEN }} persist-credentials: false - name: Get script prefix @@ -147,28 +130,18 @@ jobs: uses: bitwarden/gh-actions/get-keyvault-secrets@main with: keyvault: "bitwarden-ci" - secrets: "github-gpg-private-key, - github-gpg-private-key-passphrase, - devops-alerts-slack-webhook-url" + secrets: "devops-alerts-slack-webhook-url" - name: Log out from Azure uses: bitwarden/gh-actions/azure-logout@main - - name: Import GPG keys - uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6.3.0 - with: - gpg_private_key: ${{ steps.retrieve-secrets.outputs.github-gpg-private-key }} - passphrase: ${{ steps.retrieve-secrets.outputs.github-gpg-private-key-passphrase }} - git_user_signingkey: true - git_commit_gpgsign: true - - name: Commit and push changes id: commit env: BRANCH_NAME: ${{ steps.branch_name.outputs.branch_name }} run: | - git config --local user.email "106330231+bitwarden-devops-bot@users.noreply.github.com" - git config --local user.name "bitwarden-devops-bot" + git config --local user.email "178206702+bw-ghapp[bot]@users.noreply.github.com" + git config --local user.name "bw-ghapp[bot]" if [ -n "$(git status --porcelain)" ]; then git add . git commit -m "Move EDD database scripts" -a From 2d2e2abc5d35302632da7c90129c1e749bb1d5f2 Mon Sep 17 00:00:00 2001 From: Amy Galles <9685081+AmyLGalles@users.noreply.github.com> Date: Thu, 9 Apr 2026 21:28:20 -0700 Subject: [PATCH 4/6] sign commits with bot token --- .github/workflows/_move_edd_db_scripts.yml | 56 ++++++++++++++-------- 1 file changed, 35 insertions(+), 21 deletions(-) diff --git a/.github/workflows/_move_edd_db_scripts.yml b/.github/workflows/_move_edd_db_scripts.yml index 2151930b62ca..fe8c961fde9d 100644 --- a/.github/workflows/_move_edd_db_scripts.yml +++ b/.github/workflows/_move_edd_db_scripts.yml @@ -23,7 +23,6 @@ jobs: - name: Check out branch uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - token: ${{ secrets.GITHUB_TOKEN }} persist-credentials: false - name: Get script prefix @@ -47,14 +46,46 @@ jobs: contents: write pull-requests: write id-token: write - actions: read if: ${{ needs.setup.outputs.copy_edd_scripts == 'true' }} steps: + - name: Log in to Azure + uses: bitwarden/gh-actions/azure-login@main + with: + subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} + tenant_id: ${{ secrets.AZURE_TENANT_ID }} + client_id: ${{ secrets.AZURE_CLIENT_ID }} + + - name: Retrieve Slack secrets + id: retrieve-slack + uses: bitwarden/gh-actions/get-keyvault-secrets@main + with: + keyvault: "bitwarden-ci" + secrets: "devops-alerts-slack-webhook-url" + + - name: Retrieve secrets + id: retrieve-secret + uses: bitwarden/gh-actions/get-keyvault-secrets@main + with: + keyvault: gh-org-bitwarden + secrets: "BW-GHAPP-ID,BW-GHAPP-KEY" + + - name: Log out from Azure + uses: bitwarden/gh-actions/azure-logout@main + + - name: Generate GH App token + uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1 + id: app-token + with: + app-id: ${{ steps.retrieve-secret.outputs.BW-GHAPP-ID }} + private-key: ${{ steps.retrieve-secret.outputs.BW-GHAPP-KEY }} + owner: ${{ github.repository_owner }} + - name: Check out repo uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 persist-credentials: true + token: ${{ steps.app-token.outputs.token }} - name: Generate branch name id: branch_name @@ -118,23 +149,6 @@ jobs: echo "moved_files=$moved_files" >> "$GITHUB_OUTPUT" - - name: Log in to Azure - uses: bitwarden/gh-actions/azure-login@main - with: - subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - tenant_id: ${{ secrets.AZURE_TENANT_ID }} - client_id: ${{ secrets.AZURE_CLIENT_ID }} - - - name: Retrieve secrets - id: retrieve-secrets - uses: bitwarden/gh-actions/get-keyvault-secrets@main - with: - keyvault: "bitwarden-ci" - secrets: "devops-alerts-slack-webhook-url" - - - name: Log out from Azure - uses: bitwarden/gh-actions/azure-logout@main - - name: Commit and push changes id: commit env: @@ -158,7 +172,7 @@ jobs: id: create-pr env: BRANCH: ${{ steps.branch_name.outputs.branch_name }} - GH_TOKEN: ${{ github.token }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} MOVED_FILES: ${{ steps.move-files.outputs.moved_files }} TITLE: "Move EDD database scripts" run: | @@ -178,7 +192,7 @@ jobs: if: ${{ steps.commit.outputs.pr_needed == 'true' }} uses: act10ns/slack@44541246747a30eb3102d87f7a4cc5471b0ffb7d # v2.1.0 env: - SLACK_WEBHOOK_URL: ${{ steps.retrieve-secrets.outputs.devops-alerts-slack-webhook-url }} + SLACK_WEBHOOK_URL: ${{ steps.retrieve-slack.outputs.devops-alerts-slack-webhook-url }} with: message: "Created PR for moving EDD database scripts: ${{ steps.create-pr.outputs.pr_url }}" status: ${{ job.status }} From 0b012c3d935c61021b680df0c57f645fd7d3f909 Mon Sep 17 00:00:00 2001 From: Amy Galles <9685081+AmyLGalles@users.noreply.github.com> Date: Thu, 9 Apr 2026 21:30:49 -0700 Subject: [PATCH 5/6] replace pat token with app token --- .github/workflows/cleanup-rc-branch.yml | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/.github/workflows/cleanup-rc-branch.yml b/.github/workflows/cleanup-rc-branch.yml index 3ccccbdda163..c35770469965 100644 --- a/.github/workflows/cleanup-rc-branch.yml +++ b/.github/workflows/cleanup-rc-branch.yml @@ -21,20 +21,28 @@ jobs: client_id: ${{ secrets.AZURE_CLIENT_ID }} - name: Retrieve bot secrets - id: retrieve-bot-secrets + id: retrieve-secret uses: bitwarden/gh-actions/get-keyvault-secrets@main with: - keyvault: bitwarden-ci - secrets: "github-pat-bitwarden-devops-bot-repo-scope" + keyvault: gh-org-bitwarden + secrets: "BW-GHAPP-ID,BW-GHAPP-KEY" - name: Log out from Azure uses: bitwarden/gh-actions/azure-logout@main + - name: Generate GH App token + uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1 + id: app-token + with: + app-id: ${{ steps.retrieve-secret.outputs.BW-GHAPP-ID }} + private-key: ${{ steps.retrieve-secret.outputs.BW-GHAPP-KEY }} + owner: ${{ github.repository_owner }} + - name: Checkout main uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: main - token: ${{ steps.retrieve-bot-secrets.outputs.github-pat-bitwarden-devops-bot-repo-scope }} + token: ${{ steps.app-token.outputs.token }} persist-credentials: false fetch-depth: 0 From 3e9e447fafdfd7e3a1bda7415ad122b233628350 Mon Sep 17 00:00:00 2001 From: Amy Galles <9685081+AmyLGalles@users.noreply.github.com> Date: Tue, 14 Apr 2026 15:43:24 -0700 Subject: [PATCH 6/6] fix api signing of git commits --- .github/workflows/_move_edd_db_scripts.yml | 27 ++++++++++++---------- 1 file changed, 15 insertions(+), 12 deletions(-) diff --git a/.github/workflows/_move_edd_db_scripts.yml b/.github/workflows/_move_edd_db_scripts.yml index fe8c961fde9d..54daf6b3eed7 100644 --- a/.github/workflows/_move_edd_db_scripts.yml +++ b/.github/workflows/_move_edd_db_scripts.yml @@ -96,7 +96,9 @@ jobs: - name: "Create branch" env: BRANCH: ${{ steps.branch_name.outputs.branch_name }} - run: git switch -c "$BRANCH" + run: | + git switch -c "$BRANCH" + git push -u origin "$BRANCH" - name: Move scripts and finalization database schema id: move-files @@ -148,25 +150,26 @@ jobs: done echo "moved_files=$moved_files" >> "$GITHUB_OUTPUT" - - - name: Commit and push changes + + - name: Check for changes id: commit - env: - BRANCH_NAME: ${{ steps.branch_name.outputs.branch_name }} run: | - git config --local user.email "178206702+bw-ghapp[bot]@users.noreply.github.com" - git config --local user.name "bw-ghapp[bot]" if [ -n "$(git status --porcelain)" ]; then - git add . - git commit -m "Move EDD database scripts" -a - git push -u origin "${BRANCH_NAME}" echo "pr_needed=true" >> "$GITHUB_OUTPUT" else - echo "No changes to commit!"; echo "pr_needed=false" >> "$GITHUB_OUTPUT" - echo "### :mega: No changes to commit! PR was ommited." >> "$GITHUB_STEP_SUMMARY" + echo "No changes to commit!" + echo "### :mega: No changes to commit! PR was omitted." >> "$GITHUB_STEP_SUMMARY" fi + - name: Commit and push changes + if: ${{ steps.commit.outputs.pr_needed == 'true' }} + uses: bitwarden/gh-actions/api-commit@main + with: + token: ${{ steps.app-token.outputs.token }} + branch: ${{ steps.branch_name.outputs.branch_name }} + message: "Move EDD database scripts" + - name: Create PR for ${{ steps.branch_name.outputs.branch_name }} if: ${{ steps.commit.outputs.pr_needed == 'true' }} id: create-pr