Skip to content

feat: use codeql-ci-app for auth instead of pat #1436

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sam-robson wants to merge 1 commit into
base: main
Choose a base branch
from
+15 −4
Open

feat: use codeql-ci-app for auth instead of pat #1436

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 15 additions & 4 deletions .github/workflows/integration-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,17 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- name: Generate CI token
id: github-ci-app-token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
with:
client-id: ${{ vars.CODEQL_CI_APP_CLIENT_ID }}
owner: github
permission-contents: write
permission-actions: read
private-key: ${{ secrets.CODEQL_CI_APP_PRIVATE_KEY }}
Comment on lines +17 to +21

@mbg mbg Jul 7, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is nonsense, I think. security-events: write is not required for MRVA.

repositories: codeql-variant-analysis-action

- name: Trigger variant analysis
id: trigger
run: |
Expand All @@ -35,7 +46,7 @@ jobs:
EOF
echo "input.json: $(cat input.json)"

RESPONSE=$(curl --no-progress-meter -H "Authorization: Bearer ${{ secrets.BOT_TOKEN }}" "https://api.github.com/repos/$GITHUB_REPOSITORY/code-scanning/codeql/variant-analyses" -X POST -d @input.json)
RESPONSE=$(curl --no-progress-meter -H "Authorization: Bearer ${{ steps.github-ci-app-token.outputs.token }}" "https://api.github.com/repos/$GITHUB_REPOSITORY/code-scanning/codeql/variant-analyses" -X POST -d @input.json)
echo "Response: $RESPONSE"

ID="$(echo "$RESPONSE" | jq '.id')"
Expand All @@ -51,7 +62,7 @@ jobs:
- name: Wait for variant analysis to complete
run: |
while true; do
RESPONSE=$(curl --no-progress-meter -H "Authorization: Bearer ${{ secrets.BOT_TOKEN }}" "https://api.github.com/repos/$GITHUB_REPOSITORY/code-scanning/codeql/variant-analyses/${{ steps.trigger.outputs.variant_analysis_id }}")
RESPONSE=$(curl --no-progress-meter -H "Authorization: Bearer ${{ steps.github-ci-app-token.outputs.token }}" "https://api.github.com/repos/$GITHUB_REPOSITORY/code-scanning/codeql/variant-analyses/${{ steps.trigger.outputs.variant_analysis_id }}")
STATUS="$(echo "$RESPONSE" | jq '.status' -r)"
ACTIONS_WORKFLOW_RUN_ID="$(echo "$RESPONSE" | jq '.actions_workflow_run_id' -r)"
echo "Variant analysis ${{ steps.trigger.outputs.variant_analysis_id }} status: $STATUS"
Expand All @@ -68,7 +79,7 @@ jobs:
- name: Validate variant analysis status
id: validate
run: |
RESPONSE=$(curl --no-progress-meter -H "Authorization: Bearer ${{ secrets.BOT_TOKEN }}" "https://api.github.com/repos/$GITHUB_REPOSITORY/code-scanning/codeql/variant-analyses/${{ steps.trigger.outputs.variant_analysis_id }}")
RESPONSE=$(curl --no-progress-meter -H "Authorization: Bearer ${{ steps.github-ci-app-token.outputs.token }}" "https://api.github.com/repos/$GITHUB_REPOSITORY/code-scanning/codeql/variant-analyses/${{ steps.trigger.outputs.variant_analysis_id }}")
echo "Response: $RESPONSE"
echo "Actions workflow URL: $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$(echo "$RESPONSE" | jq '.actions_workflow_run_id')"

Expand Down Expand Up @@ -132,7 +143,7 @@ jobs:
exit 1
fi

ACTIONS_RESPONSE=$(curl --no-progress-meter -H "Authorization: Bearer ${{ secrets.BOT_TOKEN }}" "https://api.github.com/repos/$GITHUB_REPOSITORY/actions/runs/$(echo "$RESPONSE" | jq '.actions_workflow_run_id')")
ACTIONS_RESPONSE=$(curl --no-progress-meter -H "Authorization: Bearer ${{ steps.github-ci-app-token.outputs.token }}" "https://api.github.com/repos/$GITHUB_REPOSITORY/actions/runs/$(echo "$RESPONSE" | jq '.actions_workflow_run_id')")

if [ "$(echo "$ACTIONS_RESPONSE" | jq '.status' -r)" != "completed" ]; then
echo "Actions workflow status is not completed"
Expand Down
Loading