Create GITHUB token with elevated permissions

[ringods]

Hello @nmanoogian,

In #29, I contributed the setup for your repository to keep in sync with pulumi/ci-mgmt. This latter repository is used by our providers team to keep the workflows up to date for tens of provider with all the improvements they implement.

This automated setup is also usable by third parties. While Pulumi within their own Github organization uses a push based approach, third parties are setup for a weekly pull based approach. This is done via the resync_build.yaml Github Actions workflow.

For this to work, the workflow needs a Github token with elevated permissions. Please configure a Github Actions secret for this repository as described here:

https://github.com/pulumi/pulumi-tf-provider-boilerplate/blob/main/SETUP.md#configure-github-actions-ci

[ringods]

@nmanoogian any news on this secret being configured on this repo?

[nmanoogian]

Apologies for the delay, @ringods! We got swamped over here with a few infrastructure projects. I'm aiming to prioritize setup next week.

[nmanoogian]

@ringods We can't use GitHub's automatic token authentication (secrets.GITHUB_TOKEN) because of this caveat:

When you use the repository's GITHUB_TOKEN to perform tasks, events triggered by the GITHUB_TOKEN, with the exception of workflow_dispatch and repository_dispatch, will not create a new workflow run. This prevents you from accidentally creating recursive workflow runs. For example, if a workflow run pushes code using the repository's GITHUB_TOKEN, a new workflow will not run even when the repository contains a workflow configured to run when push events occur.

Is my assumption correct? Instead, I'll create a new GitHub App for this and set the app token to PULUMI_PROVIDER_AUTOMATION_TOKEN

[ringods]

@nmanoogian that caveat is indeed why we need to work with a user defined token.

Creating a github app, giving it the correct permissions to this repo (see link in first message of this issue) and then setting the token value in a secret named PULUMI_PROVIDER_AUTOMATION_TOKEN is the way forward.

[nmanoogian]

Awesome, thanks! The app has been created and installed with pull-requests: write, the private token is available under the PULUMI_PROVIDER_AUTOMATION_TOKEN secret. Let's give it a whirl!

[ringods]

@nmanoogian awesome! Can you approve #29 and have it merged?