Skip to content

Commit 8e70a37

Browse files
committed
remove usage of CAGENT_* org secrets in docs repo
Signed-off-by: Derek Misler <derek.misler@docker.com>
1 parent c7f4478 commit 8e70a37

1 file changed

Lines changed: 22 additions & 11 deletions

File tree

.github/workflows/nightly-docs-scan.yml

Lines changed: 22 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,10 @@ jobs:
2323
scan:
2424
runs-on: ubuntu-latest
2525
timeout-minutes: 20
26-
env:
27-
HAS_APP_SECRETS: ${{ secrets.CAGENT_REVIEWER_APP_ID != '' }}
26+
permissions:
27+
id-token: write
28+
contents: read
29+
issues: write
2830

2931
steps:
3032
- name: Checkout repository
@@ -45,24 +47,33 @@ jobs:
4547
restore-keys: |
4648
docs-scanner-state-${{ github.repository }}-
4749
48-
- name: Generate GitHub App token
49-
if: env.HAS_APP_SECRETS == 'true'
50-
id: app-token
50+
- name: Configure AWS credentials
51+
id: aws-credentials
5152
continue-on-error: true
52-
uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2
53+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4
5354
with:
54-
app_id: ${{ secrets.CAGENT_REVIEWER_APP_ID }}
55-
private_key: ${{ secrets.CAGENT_REVIEWER_APP_PRIVATE_KEY }}
55+
role-to-assume: arn:aws:iam::710015040892:role/docker-agent-action-20260409141318957000000001
56+
aws-region: us-east-1
57+
58+
- name: Fetch bot PAT
59+
if: steps.aws-credentials.outcome == 'success'
60+
run: |
61+
PAT=$(aws secretsmanager get-secret-value \
62+
--secret-id docker-agent-action/github-app \
63+
--query SecretString \
64+
--output text | jq -r '.pat')
65+
echo "::add-mask::$PAT"
66+
echo "GITHUB_APP_TOKEN=$PAT" >> "$GITHUB_ENV"
5667
5768
- name: Run documentation scan
5869
uses: docker/cagent-action@3a12dbd0c6cd7dda3d4e05f24f0143c9701456de # latest
5970
env:
60-
GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
71+
GH_TOKEN: ${{ env.GITHUB_APP_TOKEN || github.token }}
6172
with:
6273
agent: ${{ github.workspace }}/.github/agents/docs-scanner.yaml
63-
prompt: "${{ inputs['dry-run'] && 'DRY RUN MODE: Do not create any GitHub issues. Report what you would create but skip the gh issue create commands.' || 'Run the nightly documentation scan as described in your instructions.' }}"
74+
prompt: "${{ inputs.dry-run == true && 'DRY RUN MODE: Do not create any GitHub issues. Report what you would create but skip the gh issue create commands.' || 'Run the nightly documentation scan as described in your instructions.' }}"
6475
anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
65-
github-token: ${{ steps.app-token.outputs.token || github.token }}
76+
github-token: ${{ env.GITHUB_APP_TOKEN || github.token }}
6677
timeout: 1200
6778

6879
- name: Save scanner state

0 commit comments

Comments
 (0)