Remove GH_RAD_CI_BOT_PAT and replace it with GH APP Token

.github/workflows/build.yaml

@@ -312,8 +312,6 @@ jobs:
     needs: ["build-and-push-cli"]
     runs-on: ubuntu-latest
     if: github.repository == 'radius-project/radius' && startsWith(github.ref, 'refs/tags/v')
-    env:
-      GITHUB_TOKEN: ${{ secrets.GH_RAD_CI_BOT_PAT }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/devops-boards.yaml

@@ -5,6 +5,9 @@ on:
     types:
       [opened, edited, deleted, closed, reopened, labeled, unlabeled, assigned]
 
+env:
+  FUNCTIONAL_TEST_APP_ID: 425843
+
 concurrency:
   group: issue-${{ github.event.issue.number }}
   cancel-in-progress: false
@@ -20,6 +23,12 @@ jobs:
     environment:
       name: issues
     steps:
+      - name: Get GitHub app token
+        uses: tibdex/github-app-token@v2
+        id: get_installation_token
+        with:
+          app_id: ${{ env.FUNCTIONAL_TEST_APP_ID }}
+          private_key: ${{ secrets.FUNCTIONAL_TEST_APP_PRIVATE_KEY }}
       # Auth using Azure Service Principals was added as a part of v2.3
       # reference: https://github.com/danhellem/github-actions-issue-to-work-item/pull/143
       - name: Login to Azure
@@ -38,7 +47,7 @@ jobs:
         uses: danhellem/[email protected]
         env:
           ado_token: ${{ env.ADO_TOKEN }}
-          github_token: '${{ secrets.GH_RAD_CI_BOT_PAT }}'
+          github_token: ${{ steps.get_installation_token.outputs.token }}
           ado_organization: 'azure-octo'
           ado_project: 'Incubations'
           ado_area_path: "Incubations\\Radius"

.github/workflows/functional-test-cloud.yaml

@@ -191,7 +191,7 @@ jobs:
         if: github.event_name == 'repository_dispatch'
         uses: actions/github-script@v7
         with:
-          github-token: ${{ secrets.GH_RAD_CI_BOT_PAT }}
+          github-token: ${{ steps.get_installation_token.outputs.token }}
           script: |
             const clientPayload = context.payload.client_payload;
             if (clientPayload && clientPayload.event_type === `de-functional-test`) {
@@ -570,7 +570,7 @@ jobs:
           # AZURE_OIDC_ISSUER
           eval "export $(echo "${{ secrets.FUNCTEST_AZURE_OIDC_JSON }}" | jq -r 'to_entries | map("\(.key)=\(.value)") | @sh')"
 
-          AUTHKEY=$(echo -n "${{ github.actor }}:${{ secrets.GH_RAD_CI_BOT_PAT }}" | base64)
+          AUTHKEY=$(echo -n "${{ github.actor }}:${{ steps.get_installation_token.outputs.token }}" | base64)
           echo "{\"auths\":{\"ghcr.io\":{\"auth\":\"${AUTHKEY}\"}}}" > "./ghcr_secret.json"
 
           # Create KinD cluster with OIDC Issuer keys
@@ -944,10 +944,16 @@ jobs:
     runs-on: ubuntu-latest
     if: failure() && github.event_name == 'schedule' && github.repository == 'radius-project/radius'
     steps:
+      - name: Get GitHub app token
+        uses: tibdex/github-app-token@v2
+        id: get_installation_token
+        with:
+          app_id: ${{ env.FUNCTIONAL_TEST_APP_ID }}
+          private_key: ${{ secrets.FUNCTIONAL_TEST_APP_PRIVATE_KEY }}
       - name: Create failure issue for failing scheduled run
         uses: actions/github-script@v7
         with:
-          github-token: ${{ secrets.GH_RAD_CI_BOT_PAT }}
+          github-token: ${{ steps.get_installation_token.outputs.token }}
           script: |
             github.rest.issues.create({
               ...context.repo,

.github/workflows/functional-test-noncloud.yaml

@@ -74,6 +74,8 @@ env:
   LOCAL_REGISTRY_PORT: "5000"
   # bicep-types ACR url for uploading Radius Bicep types
   BICEP_TYPES_REGISTRY: 'biceptypes.azurecr.io'
+  # The functional test GitHub app id
+  FUNCTIONAL_TEST_APP_ID: 425843
 
 jobs:
   build:
@@ -87,11 +89,17 @@ jobs:
       DE_IMAGE: ${{ steps.gen-id.outputs.DE_IMAGE }}
       DE_TAG: ${{ steps.gen-id.outputs.DE_TAG }}
     steps:
+      - name: Get GitHub app token
+        uses: tibdex/github-app-token@v2
+        id: get_installation_token
+        with:
+          app_id: ${{ env.FUNCTIONAL_TEST_APP_ID }}
+          private_key: ${{ secrets.FUNCTIONAL_TEST_APP_PRIVATE_KEY }}
       - name: Set DE image and tag (repository_dispatch from de-functional-test)
         if: github.event_name == 'repository_dispatch'
         uses: actions/github-script@v7
         with:
-          github-token: ${{ secrets.GH_RAD_CI_BOT_PAT }}
+          github-token: ${{ steps.get_installation_token.outputs.token }}
           script: |
             const clientPayload = context.payload.client_payload;
             if (clientPayload && clientPayload.event_type === `de-functional-test`) {
@@ -478,10 +486,16 @@ jobs:
     runs-on: ubuntu-latest
     if: failure() && github.event_name == 'schedule' && github.repository == 'radius-project/radius'
     steps:
+      - name: Get GitHub app token
+        uses: tibdex/github-app-token@v2
+        id: get_installation_token
+        with:
+          app_id: ${{ env.FUNCTIONAL_TEST_APP_ID }}
+          private_key: ${{ secrets.FUNCTIONAL_TEST_APP_PRIVATE_KEY }}
       - name: Create failure issue for failing scheduled run
         uses: actions/github-script@v7
         with:
-          github-token: ${{ secrets.GH_RAD_CI_BOT_PAT }}
+          github-token: ${{ steps.get_installation_token.outputs.token }}
           script: |
             github.rest.issues.create({
               ...context.repo,

.github/workflows/long-running-azure.yaml

@@ -324,7 +324,7 @@ jobs:
         with:
           repository: radius-project/samples
           ref: refs/heads/edge
-          token: ${{ secrets.GH_RAD_CI_BOT_PAT }}
+          token: ${{ steps.get_installation_token.outputs.token }}
           path: samples
       - name: Set up Go ${{ env.GOVER }}
         uses: actions/setup-go@v5
@@ -600,10 +600,16 @@ jobs:
     runs-on: ubuntu-latest
     if: failure() && github.repository == 'radius-project/radius' && github.event_name == 'schedule'
     steps:
+      - name: Get GitHub app token
+        uses: tibdex/github-app-token@v2
+        id: get_installation_token
+        with:
+          app_id: ${{ env.FUNCTIONAL_TEST_APP_ID }}
+          private_key: ${{ secrets.FUNCTIONAL_TEST_APP_PRIVATE_KEY }}
       - name: Create failure issue for failing long running test run
         uses: actions/github-script@v7
         with:
-          github-token: ${{ secrets.GH_RAD_CI_BOT_PAT }}
+          github-token: ${{ steps.get_installation_token.outputs.token }}
           script: |
             github.rest.issues.create({
               ...context.repo,

.github/workflows/publish-docs.yaml

@@ -18,6 +18,8 @@ on:
   pull_request:
     branches:
       - main
+env:
+  FUNCTIONAL_TEST_APP_ID: 425843
 jobs:
   reference-docs:
     name: Generate and PR reference documentation
@@ -27,6 +29,12 @@ jobs:
       GOVER: "1.22.2"
       GOPRIVATE: github.com/radius-project
     steps:
+      - name: Get GitHub app token
+        uses: tibdex/github-app-token@v2
+        id: get_installation_token
+        with:
+          app_id: ${{ env.FUNCTIONAL_TEST_APP_ID }}
+          private_key: ${{ secrets.FUNCTIONAL_TEST_APP_PRIVATE_KEY }}
       - name: Checkout radius repository
         uses: actions/checkout@v4
         with:
@@ -107,7 +115,7 @@ jobs:
         if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.open_pull_request == 'true')
         uses: peter-evans/create-pull-request@v7
         with:
-          token: ${{ secrets.GH_RAD_CI_BOT_PAT }}
+          token: ${{ steps.get_installation_token.outputs.token }}
           path: docs
           add-paths: |
             *.md

.github/workflows/purge-aws-test-resources.yaml

@@ -22,6 +22,7 @@ on:
     - cron: "0 7 * * 0-6"
 
 env:
+  FUNCTIONAL_TEST_APP_ID: 425843
   AWS_REGION: us-west-2
   AWS_RESOURCE_TYPES: "AWS::RDS::DBSubnetGroup,AWS::RDS::DBInstance,AWS::S3::Bucket,AWS::Logs::MetricFilter,AWS::Logs::LogGroup"
   # The current GitHub action link
@@ -33,6 +34,12 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'radius-project/radius'
     steps:
+      - name: Get GitHub app token
+        uses: tibdex/github-app-token@v2
+        id: get_installation_token
+        with:
+          app_id: ${{ env.FUNCTIONAL_TEST_APP_ID }}
+          private_key: ${{ secrets.FUNCTIONAL_TEST_APP_PRIVATE_KEY }}
       - name: Checkout the repository
         uses: actions/checkout@v4
       - name: Configure AWS Credentials
@@ -48,7 +55,7 @@ jobs:
         uses: actions/github-script@v7
         if: failure()
         with:
-          github-token: ${{ secrets.GH_RAD_CI_BOT_PAT }}
+          github-token: ${{ steps.get_installation_token.outputs.token }}
           script: |
             github.rest.issues.create({
               ...context.repo,

.github/workflows/purge-azure-test-resources.yaml

@@ -29,6 +29,8 @@ on:
     - cron: "30 0,12 * * *"
 
 env:
+  FUNCTIONAL_TEST_APP_ID: 425843
+
   AZURE_RG_DELETE_LIST_FILE: "az_rg_list.txt"
   # The valid resource time window in seconds to delete the test resources. 6 hours
   VALID_RESOURCE_WINDOW: 6*60*60
@@ -124,9 +126,15 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ failure() && github.event_name != 'workflow_dispatch' }}
     steps:
+      - name: Get GitHub app token
+        uses: tibdex/github-app-token@v2
+        id: get_installation_token
+        with:
+          app_id: ${{ env.FUNCTIONAL_TEST_APP_ID }}
+          private_key: ${{ secrets.FUNCTIONAL_TEST_APP_PRIVATE_KEY }}
       - uses: actions/github-script@v7
         with:
-          github-token: ${{ secrets.GH_RAD_CI_BOT_PAT }}
+          github-token: ${{ steps.get_installation_token.outputs.token }}
           script: |
             github.rest.issues.create({
               ...context.repo,

.github/workflows/purge-old-images.yaml

@@ -14,18 +14,25 @@ on:
 
 env:
   ACTION_LINK: "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+  FUNCTIONAL_TEST_APP_ID: 425843
 
 jobs:
   purge_ghcr_dev:
     name: Delete old unused test container images
     runs-on: ubuntu-latest
     if: github.repository == 'radius-project/radius'
     steps:
+      - name: Get GitHub app token
+        uses: tibdex/github-app-token@v2
+        id: get_installation_token
+        with:
+          app_id: ${{ env.FUNCTIONAL_TEST_APP_ID }}
+          private_key: ${{ secrets.FUNCTIONAL_TEST_APP_PRIVATE_KEY }}
       - name: Delete 'dev' containers older than a week
         uses: snok/[email protected]
         with:
           account: radius-project
-          token: ${{ secrets.GH_RAD_CI_BOT_PAT }}
+          token: ${{ steps.get_installation_token.outputs.token }}
           image-names: dev/*
           image-tags: "pr-*"
           cut-off: 1w
@@ -36,9 +43,15 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ failure() && github.event_name != 'workflow_dispatch' }}
     steps:
+      - name: Get GitHub app token
+        uses: tibdex/github-app-token@v2
+        id: get_installation_token
+        with:
+          app_id: ${{ env.FUNCTIONAL_TEST_APP_ID }}
+          private_key: ${{ secrets.FUNCTIONAL_TEST_APP_PRIVATE_KEY }}
       - uses: actions/github-script@v7
         with:
-          github-token: ${{ secrets.GH_RAD_CI_BOT_PAT }}
+          github-token: ${{ steps.get_installation_token.outputs.token }}
           script: |
             github.rest.issues.create({
               ...context.repo,

.github/workflows/radius-bot.yaml

@@ -4,11 +4,20 @@ on:
   issue_comment:
     types: [created]
 
+env:
+  FUNCTIONAL_TEST_APP_ID: 425843
+
 jobs:
   radius-bot:
     name: Run Radius Bot script
     runs-on: ubuntu-latest
     steps:
+      - name: Get GitHub app token
+        uses: tibdex/github-app-token@v2
+        id: get_installation_token
+        with:
+          app_id: ${{ env.FUNCTIONAL_TEST_APP_ID }}
+          private_key: ${{ secrets.FUNCTIONAL_TEST_APP_PRIVATE_KEY }}
       - name: Checkout Repository
         uses: actions/checkout@v4
         with:
@@ -20,7 +29,7 @@ jobs:
         env:
           TEAM_SLUG: 'approvers-radius'
         with:
-          github-token: ${{ secrets.GH_RAD_CI_BOT_PAT }}
+          github-token: ${{ steps.get_installation_token.outputs.token }}
           script: |
             const script = require('./.github/scripts/radius-bot.js')
             await script({github, context})