From 6a02f1a3b1843903e3af62eb358b625718c0369d Mon Sep 17 00:00:00 2001 From: Miguel Allende Date: Fri, 14 Aug 2026 10:06:13 +0200 Subject: [PATCH 1/2] use ephemeral github token in updatecli --- .github/workflows/updatecli.yml | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/.github/workflows/updatecli.yml b/.github/workflows/updatecli.yml index ba998c52d..34f6b27c6 100644 --- a/.github/workflows/updatecli.yml +++ b/.github/workflows/updatecli.yml @@ -13,21 +13,15 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + id-token: write packages: read steps: - uses: actions/checkout@v7 + # TokenPolicy defined at https://github.com/elastic/catalog-info/tree/main/resources/github-token-policies/token-policy-apm-agent-ruby-updatecli.yaml - name: Get token id: get_token - uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0 - with: - app_id: ${{ secrets.OBS_AUTOMATION_APP_ID }} - private_key: ${{ secrets.OBS_AUTOMATION_APP_PEM }} - permissions: >- - { - "contents": "write", - "pull_requests": "write" - } + uses: elastic/oblt-actions/github/create-token@v1 - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: From 2eb9c57917603a91a21f47d2a6744f97eaf810e4 Mon Sep 17 00:00:00 2001 From: Miguel Allende Date: Fri, 14 Aug 2026 10:06:13 +0200 Subject: [PATCH 2/2] align updatecli committer with github-actions bot --- .ci/updatecli/values.d/scm.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.ci/updatecli/values.d/scm.yml b/.ci/updatecli/values.d/scm.yml index 16262012d..0163a8fae 100644 --- a/.ci/updatecli/values.d/scm.yml +++ b/.ci/updatecli/values.d/scm.yml @@ -5,6 +5,6 @@ scm: branch: main commitusingapi: true # begin update-compose policy values - user: obltmachine - email: obltmachine@users.noreply.github.com + user: 'github-actions[bot]' + email: '41898282+github-actions[bot]@users.noreply.github.com' # end update-compose policy values