feat: support app creds for checkout

Author: galargh

.github/workflows/go-check.yml

@@ -12,17 +12,23 @@ on:
         required: false
         type: boolean
         default: false
-      env:
-        required: false
-        type: string
       runner:
         required: false
         type: string
         default: '"ubuntu-latest"'
+      env:
+        required: false
+        type: string
       checkout-token:
         required: false
         type: string
         default: ${{ github.token }}
+      checkout-app-id:
+        required: false
+        type: string
+      checkout-private-key:
+        required: false
+        type: string
 
 jobs:
   unit:
@@ -35,11 +41,19 @@ jobs:
           ENV: ${{ inputs.env }}
         run: |
           echo "$ENV" >> $GITHUB_ENV
+      - name: Create GitHub App installation token
+        id: checkout-app
+        if: ${{ inputs.checkout-app-id && inputs.checkout-private-key }}
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ inputs.checkout-app-id }}
+          private-key: ${{ inputs.checkout-private-key }}
+          owner: ${{ github.repository_owner }}
       - name: Check out the repository
         uses: actions/checkout@v5
         with:
           submodules: recursive
-          token: ${{ inputs.checkout-token }}
+          token: ${{ steps.checkout-app.outputs.token || inputs.checkout-token }}
       - name: Extend the GitHub context
         id: github
         env:

.github/workflows/go-test.yml

@@ -2,6 +2,10 @@ name: Go Test
 on:
   workflow_call:
     inputs:
+      os-versions:
+        required: false
+        type: string
+        default: '["ubuntu", "windows", "macos"]'
       go-versions:
         required: false
         type: string
@@ -10,9 +14,6 @@ on:
         required: false
         type: boolean
         default: false
-      env:
-        required: false
-        type: string
       runner-ubuntu:
         required: false
         type: string
@@ -25,14 +26,20 @@ on:
         required: false
         type: string
         default: '"macos-latest"'
-      os-versions:
+      env:
         required: false
         type: string
-        default: '["ubuntu", "windows", "macos"]'
       checkout-token:
         required: false
         type: string
         default: ${{ github.token }}
+      checkout-app-id:
+        required: false
+        type: string
+      checkout-private-key:
+        required: false
+        type: string
+
     secrets:
       CODECOV_TOKEN:
         required: false
@@ -61,6 +68,14 @@ jobs:
           ENV: ${{ inputs.env }}
         run: |
           echo "$ENV" >> $GITHUB_ENV
+      - name: Create GitHub App installation token
+        id: checkout-app
+        if: ${{ inputs.checkout-app-id && inputs.checkout-private-key }}
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ inputs.checkout-app-id }}
+          private-key: ${{ inputs.checkout-private-key }}
+          owner: ${{ github.repository_owner }}
       - name: Use msys2 on windows
         if: matrix.os == 'windows'
         # The executable for msys2 is also called bash.cmd
@@ -72,7 +87,7 @@ jobs:
         uses: actions/checkout@v5
         with:
           submodules: recursive
-          token: ${{ inputs.checkout-token }}
+          token: ${{ steps.checkout-app.outputs.token || inputs.checkout-token }}
       - name: Check out the latest stable version of Go
         id: stable
         uses: actions/setup-go@v5

.github/workflows/release-check.yml

@@ -14,17 +14,10 @@ on:
         required: false
         type: string
         default: '/'
-      env:
-        required: false
-        type: string
       runner:
         required: false
         type: string
         default: '"ubuntu-latest"'
-      checkout-token:
-        required: false
-        type: string
-        default: ${{ github.token }}
     outputs:
       json:
         description: JSON aggregation of release.json artifacts

.github/workflows/releaser.yml

@@ -18,21 +18,10 @@ on:
         required: false
         type: boolean
         default: false
-      env:
-        required: false
-        type: string
       runner:
         required: false
         type: string
         default: '"ubuntu-latest"'
-      checkout-token:
-        required: false
-        type: string
-        default: ${{ github.token }}
-      release-token:
-        required: false
-        type: string
-        default: ${{ github.token }}
     outputs:
       json:
         description: JSON aggregation of release.json artifacts
@@ -171,7 +160,7 @@ jobs:
           generate_release_notes: true
           target_commitish: ${{ github.sha }}
           make_latest: ${{ steps.version.outputs.prefix == 'v' && steps.version.outputs.suffix == '' && steps.version.outputs.tag == steps.latest.outputs.latest }}
-          token: ${{ secrets.UCI_GITHUB_TOKEN || inputs.release-token }}
+          token: ${{ secrets.UCI_GITHUB_TOKEN || github.token }}
       - name: Create release.json
         if: steps.release.outputs.id != ''
         id: json

CHANGELOG.md

@@ -6,8 +6,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 ### Added
-- `env` input support to `go-test`, `go-check`, `releaser` and `release-check` workflows
-- `checkout-token` input support to `go-test`, `go-check`, `releaser` and `release-check` workflows
+- `env` input support to `go-test` and `go-check` workflows
+- `checkout-token`, `checkout-app-id` and `checkout-private-key` input support to `go-test` and `go-check` workflows
 - custom `runner` configuration to most workflows
 - `os-versions` input support to `go-test` workflow