firezone / firezone / 41396057797

80%

push

github

ci: replace firezone-bot with the firezone-ci app (#16155)

Bot automation now acts as the `firezone-ci` GitHub App instead of the
`firezone-bot` user, which leaves the organisation. Each job mints a
short-lived token scoped to the repository and permissions it needs, and
commits through the reusable actions in firezone/actions, which go
through the GitHub API so GitHub signs the commits. This covers the fuzz
corpus proposals, the release version bump PRs and the dispatches to
firezone/website. The screenshot commit keeps using `GITHUB_TOKEN`, so
it still does not start new workflows. The version bump now starts from
the default branch rather than the release tag, so its PR carries the
current files.

winget releases no longer wait for someone to sync
`firezone/winget-pkgs` by hand: the app syncs the fork, then komac
submits the manifests with `WINGET_TOKEN`, as before. Apps cannot open
pull requests in `microsoft/winget-pkgs`, so that stays the
`public_repo` token of `firezone-bot`, now an outside collaborator on
the fork only.

---------

Co-authored-by: Claude <noreply@anthropic.com>

1372 of 2287 branches covered (59.99%)

Branch coverage included in aggregate %.

94496 of 117426 relevant lines covered (80.47%)

369497.16 hits per line