ci: use gh app to generate token rather than classic token (#35)

* ci: use gh app to generate token rather than classic token

* ci: remove permfix (internal)

Author: kelly-sovacool

.github/workflows/sync-forks.yml

@@ -12,9 +12,6 @@ permissions:
   contents: write
 
 env:
-  # Token must be created by someone with write access for all forks.
-  # Be sure to 'configure SSO' from the token creation page for each fork organization.
-  GH_TOKEN: ${{ secrets.SYNC_FORK_TOKEN }}
   UPSTREAM_OWNER: CCBR
 
 jobs:
@@ -42,7 +39,6 @@ jobs:
           - l2p
           - METRO
           - MAAPSTER
-          - permfix
           - pyrkit
           - rNA
           - SINCLAIR
@@ -51,7 +47,17 @@ jobs:
           - MAPLE
           - LOGAN
     steps:
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ vars.CCBR_BOT_APP_ID }}
+          private-key: ${{ secrets.CCBR_BOT_PRIVATE_KEY }}
+          owner: ${{ matrix.FORK_OWNER }}
+
       - name: sync forked repos
+        env:
+          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
         run: |
           gh repo sync ${{ matrix.FORK_OWNER }}/${{ matrix.REPO }} --source $UPSTREAM_OWNER/${{ matrix.REPO }} --force
 
@@ -63,7 +69,17 @@ jobs:
         FORK_OWNER: [NCIPangea]
         REPO: [ASPEN, CARLISLE, CHAMPAGNE, CRISPIN, RENEE, XAVIER]
     steps:
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ vars.CCBR_BOT_APP_ID }}
+          private-key: ${{ secrets.CCBR_BOT_PRIVATE_KEY }}
+          owner: ${{ matrix.FORK_OWNER }}
+
       - name: sync forked repos
+        env:
+          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
         run: |
           gh repo sync ${{ matrix.FORK_OWNER }}/${{ matrix.REPO }} --source $UPSTREAM_OWNER/${{ matrix.REPO }} --force
 
@@ -83,7 +99,17 @@ jobs:
           - DSP_Analysis
 
     steps:
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ vars.CCBR_BOT_APP_ID }}
+          private-key: ${{ secrets.CCBR_BOT_PRIVATE_KEY }}
+          owner: ${{ matrix.FORK_OWNER }}
+
       - name: sync forked repos
+        env:
+          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
         run: |
           gh repo sync ${{ matrix.FORK_OWNER }}/${{ matrix.REPO }} --source $UPSTREAM_OWNER/${{ matrix.REPO }} --force
 
@@ -103,6 +129,16 @@ jobs:
             UPSTREAM_OWNER: NCI-CCDI
             FORK_OWNER: abcsFrederick
     steps:
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ vars.CCBR_BOT_APP_ID }}
+          private-key: ${{ secrets.CCBR_BOT_PRIVATE_KEY }}
+          owner: ${{ matrix.FORK_OWNER }}
+
       - name: sync forked repos
+        env:
+          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
         run: |
           gh repo sync ${{ matrix.FORK_OWNER }}/${{ matrix.REPO }} --source ${{matrix.UPSTREAM_OWNER}}/${{ matrix.REPO }} --force