Checkout with token (#2041)

Author: ashdavies

.github/workflows/upgrade-yarn.yml

@@ -16,7 +16,25 @@ jobs:
       id-token: 'write'
 
     steps:
+      - id: token
+        run: |
+          APP_TOKEN=$(
+            ./scripts/generate_signed_jwt.sh \
+              --issuer "${{ secrets.GH_APP_ID }}" \
+              --private-key "${{ secrets.GH_PRIVATE_KEY }}" \
+          )
+          
+          GITHUB_TOKEN=$(
+            ./scripts/github_install_token.sh \
+            --app-token $APP_TOKEN \
+          )
+          
+          echo "::set-output name=APP_TOKEN::$GITHUB_TOKEN"
+          echo "::set-output name=GITHUB_TOKEN::$GITHUB_TOKEN"
+
       - uses: actions/checkout@v5
+        with:
+          token: ${{ steps.token.outputs.APP_TOKEN }}
 
       - uses: google-github-actions/auth@v3
         with:
@@ -30,18 +48,7 @@ jobs:
       - env:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
-          APP_TOKEN=$(
-            ./scripts/generate_signed_jwt.sh \
-              --issuer "${{ secrets.GH_APP_ID }}" \
-              --private-key "${{ secrets.GH_PRIVATE_KEY }}" \
-          )
-          
-          GITHUB_TOKEN=$(
-            ./scripts/github_install_token.sh \
-              --app-token $APP_TOKEN \
-          )
-
           ./scripts/github_pull_request.sh \
-            --app-token "$APP_TOKEN" \
-            --github-token "$GITHUB_TOKEN" \
+            --app-token "${{ steps.token.outputs.APP_TOKEN }}" \
+            --github-token "${{ steps.token.outputs.GITHUB_TOKEN }}" \
             --commit-msg "chore: upgrade yarn lock"

scripts/github_pull_request.sh

@@ -4,7 +4,7 @@ set -eo pipefail
 
 show_help() {
   cat << EOF
-Usage: $(basename "$0") --app-token <APP_TOKEN> --commit-msg <COMMIT_MSG>
+Usage: $(basename "$0") --app-token <APP_TOKEN> --github-token <GITHUB_TOKEN> --commit-msg <COMMIT_MSG>
 
 Automates the workflow of creating a branch, committing staged and unstaged changes, pushing to GitHub, and creating a PR.