From 7b1c79a17b6aec0ef445f92f026d4bb5b6dc349d Mon Sep 17 00:00:00 2001 From: Jeremy Stein Date: Thu, 10 Sep 2026 14:29:20 +0100 Subject: [PATCH 1/3] Use documented method of accessing private repos in the org, but I don't think it'll work until it's enabled at the org level --- .github/workflows/comment.yaml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/comment.yaml b/.github/workflows/comment.yaml index 54cedecf0..65e77081a 100644 --- a/.github/workflows/comment.yaml +++ b/.github/workflows/comment.yaml @@ -8,11 +8,17 @@ jobs: comment: runs-on: ubuntu-latest steps: + - name: Generate GitHub App Token + id: generate-token + uses: actions/create-github-app-token@v1 + with: + app-id: ${{ secrets.SAFEHR_WORKER_APP_ID }} + private-key: ${{ secrets.SAFEHR_WORKER_APP_KEY }} - name: Checkout documentation uses: actions/checkout@v4 with: repository: SAFEHR-data/internal_emap_documentation - token: ${{ secrets.GH_PAT_READ_AND_COMMENT }} + token: ${{ steps.generate-token.outputs.token }} ref: main - id: get-pr-checklist name: Get PR checklist From a11b31cb0ae4fd03dcfa7b857840923e019f3138 Mon Sep 17 00:00:00 2001 From: Jeremy Stein Date: Thu, 10 Sep 2026 14:45:44 +0100 Subject: [PATCH 2/3] emap-setup tests also needs a token for cloning private repos --- .github/workflows/emap-setup-tests.yaml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/.github/workflows/emap-setup-tests.yaml b/.github/workflows/emap-setup-tests.yaml index d351ac30c..17ec6631a 100644 --- a/.github/workflows/emap-setup-tests.yaml +++ b/.github/workflows/emap-setup-tests.yaml @@ -28,10 +28,16 @@ jobs: emap-setup-tests: needs: [filter] runs-on: ubuntu-latest - env: - GITHUB_TOKEN: ${{ secrets.GH_PAT_READ_AND_COMMENT }} if: needs.filter.outputs.emap-setup == 'true' steps: + # emap-setup test performs clones of private repos as part of the test, so + # a token is needed to be able to do that + - name: Generate GitHub App Token + id: generate-token + uses: actions/create-github-app-token@v1 + with: + app-id: ${{ secrets.SAFEHR_WORKER_APP_ID }} + private-key: ${{ secrets.SAFEHR_WORKER_APP_KEY }} - uses: actions/checkout@v3 - name: Set up python uses: actions/setup-python@v5 @@ -42,6 +48,8 @@ jobs: run: | python -m pip install -r emap-setup/requirements.txt - name: Run tests + with: + token: ${{ steps.generate-token.outputs.token }} run: | cd emap-setup pytest --cov=./ --cov-report=term From aa61c53ca1f105fda60cbadd9647c1e5f3e5f65f Mon Sep 17 00:00:00 2001 From: Jeremy Stein Date: Thu, 10 Sep 2026 16:43:35 +0100 Subject: [PATCH 3/3] Switch to the read-only keys as we only need read-only access --- .github/workflows/comment.yaml | 4 ++-- .github/workflows/emap-setup-tests.yaml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/comment.yaml b/.github/workflows/comment.yaml index 65e77081a..f31575e64 100644 --- a/.github/workflows/comment.yaml +++ b/.github/workflows/comment.yaml @@ -12,8 +12,8 @@ jobs: id: generate-token uses: actions/create-github-app-token@v1 with: - app-id: ${{ secrets.SAFEHR_WORKER_APP_ID }} - private-key: ${{ secrets.SAFEHR_WORKER_APP_KEY }} + app-id: ${{ secrets.SAFEHR_READ_ONLY_WORKER_ID }} + private-key: ${{ secrets.SAFEHR_READ_ONLY_WORKER_KEY }} - name: Checkout documentation uses: actions/checkout@v4 with: diff --git a/.github/workflows/emap-setup-tests.yaml b/.github/workflows/emap-setup-tests.yaml index 17ec6631a..1d4649d57 100644 --- a/.github/workflows/emap-setup-tests.yaml +++ b/.github/workflows/emap-setup-tests.yaml @@ -36,8 +36,8 @@ jobs: id: generate-token uses: actions/create-github-app-token@v1 with: - app-id: ${{ secrets.SAFEHR_WORKER_APP_ID }} - private-key: ${{ secrets.SAFEHR_WORKER_APP_KEY }} + app-id: ${{ secrets.SAFEHR_READ_ONLY_WORKER_ID }} + private-key: ${{ secrets.SAFEHR_READ_ONLY_WORKER_KEY }} - uses: actions/checkout@v3 - name: Set up python uses: actions/setup-python@v5