chore: update automation (#828)

.github/actions/docs-pr/action.yml

@@ -1,7 +1,7 @@
-# This composite action constructs and opens a pull request on the
-# docs website repository.
-
 name: 'Docs PR'
+description: >
+  This composite action constructs and opens a pull request on the
+  docs website repository.
 
 inputs:
   tag:
@@ -10,12 +10,13 @@ inputs:
   github_login:
     description: 'Github login associated with github authentication token.'
     required: true
-  github_token:
-    description: "The github token to use for interacting with the repositories."
-    required: true
   github_email:
     description: 'Email address associated with github login user.'
     required: true
+  nr_docs_github_token:
+    description: 'New Relic github org authentication token scoped to the docs repo'
+  nr_forks_github_token:
+    description: 'New Relic Forks github org authentication token'
 
 runs:
   using: "composite"
@@ -29,6 +30,7 @@ runs:
         node $GITHUB_ACTION_PATH/index.js \
           --tag ${{ inputs.tag }} \
           --github-login ${{ inputs.github_login }} \
-          --github-token ${{ inputs.github_token }} \
-          --github-email ${{ inputs.github_email }}
+          --github-email ${{ inputs.github_email }} \
+          --nr-docs-github-token ${{ inputs.nr_docs_github_token }} \
+          --nr-forks-github-token ${{ inputs.nr_forks_github_token }}
       shell: bash

.github/actions/docs-pr/args.js

@@ -11,15 +11,18 @@ export const args = yargs(hideBin(process.argv))
   .string('githubLogin')
   .describe('githubLogin', 'Github login associated with github authentication token')
 
-  .string('githubToken')
-  .describe('githubToken', 'Github authentication token')
-
   .string('githubUserName')
   .describe('githubUserName', 'User name associated with github login user')
   .default('githubUserName', 'Browser Agent Team')
 
   .string('githubEmail')
   .describe('githubEmail', 'Email address associated with github login user')
 
-  .demandOption(['tag', 'githubLogin', 'githubToken', 'githubUserName', 'githubEmail'])
+  .string('nrDocsGithubToken')
+  .describe('nrDocsGithubToken', 'New Relic github org authentication token scoped to the docs repo')
+
+  .string('nrForksGithubToken')
+  .describe('nrForksGithubToken', 'New Relic Forks github org authentication token')
+
+  .demandOption(['tag', 'githubLogin', 'githubUserName', 'githubEmail', 'nrDocsGithubToken', 'nrForksGithubToken'])
   .argv

.github/actions/docs-pr/index.js

@@ -16,7 +16,7 @@ import {
 } from './constants.js'
 import { GitCliRunner } from '../shared-utils/git-cli-runner.js'
 
-const octokit = github.getOctokit(args.githubToken)
+const forksOctokit = github.getOctokit(args.nrForksGithubToken)
 
 // Get the release change log
 const versionData = JSON.parse(await fs.promises.readFile(CHANGELOG_FILE_PATH)).entries.find(
@@ -32,7 +32,7 @@ const categories = {
 }
 for (const change of versionData.changes) {
   if (categories[change.type]) {
-    const entries = await octokit.request('GET /repos/{owner}/{repo}/commits/{commit_sha}/pulls', {
+    const entries = await forksOctokit.request('GET /repos/{owner}/{repo}/commits/{commit_sha}/pulls', {
       owner: github.context.repo.owner,
       repo: github.context.repo.repo,
       commit_sha: change.sha
@@ -110,20 +110,20 @@ await fs.promises.mkdir(DOCS_FORK_CLONE_PATH, { recursive: true })
 const branchName = `add-browser-agent-${args.tag}`
 
 console.log('Syncing docs fork')
-await octokit.rest.repos.mergeUpstream({
+await forksOctokit.rest.repos.mergeUpstream({
   owner: DOCS_SITE_FORK_GITHUB_OWNER,
   repo: DOCS_SITE_FORK_GITHUB_REPO,
   branch: DOCS_SITE_REPO_BASE
 })
 
 try {
   console.log(`Deleting remote branch ${branchName}`)
-  await octokit.rest.git.getRef({
+  await forksOctokit.rest.git.getRef({
     owner: DOCS_SITE_FORK_GITHUB_OWNER,
     repo: DOCS_SITE_FORK_GITHUB_REPO,
     ref: `heads/${branchName}`
   }) // <-- This will throw an error if the branch does not exist
-  await octokit.rest.git.deleteRef({
+  await forksOctokit.rest.git.deleteRef({
     owner: DOCS_SITE_FORK_GITHUB_OWNER,
     repo: DOCS_SITE_FORK_GITHUB_REPO,
     ref: `heads/${branchName}`
@@ -135,7 +135,7 @@ try {
     throw error
   }
 }
-const gitCliRunner = new GitCliRunner(DOCS_FORK_CLONE_PATH, args.githubLogin, args.githubToken, args.githubUserName, args.githubEmail)
+const gitCliRunner = new GitCliRunner(DOCS_FORK_CLONE_PATH, args.githubLogin, args.nrForksGithubToken, args.githubUserName, args.githubEmail)
 await gitCliRunner.clone(DOCS_SITE_FORK_GITHUB_OWNER, DOCS_SITE_FORK_GITHUB_REPO)
 await gitCliRunner.createBranch(branchName)
 
@@ -155,7 +155,8 @@ await gitCliRunner.commitFile(releaseNotesFile, `chore: Add Browser agent ${args
 await gitCliRunner.push(branchName)
 
 console.log('Opening pull request')
-await octokit.rest.pulls.create({
+const docsOctokit = github.getOctokit(args.nrDocsGithubToken)
+await docsOctokit.rest.pulls.create({
   owner: DOCS_SITE_GITHUB_OWNER,
   repo: DOCS_SITE_GITHUB_REPO,
   head: `${DOCS_SITE_FORK_GITHUB_OWNER}:${branchName}`,

.github/workflows/post-release-updates.yml

@@ -26,5 +26,5 @@ jobs:
         uses: ./.github/actions/post-release-updates
         with:
           github_login: ${{ secrets.BROWSER_GITHUB_BOT_NAME }}
-          github_token: ${{ secrets.BROWSER_GITHUB_BOT_PAT }}
+          github_token: ${{ secrets.BROWSER_GITHUB_BOT_INTERNAL_PAT }}
           github_email: ${{ secrets.BROWSER_GITHUB_BOT_EMAIL }}

.github/workflows/publish-release.yml

@@ -214,8 +214,9 @@ jobs:
         with:
           tag: v${{ steps.agent-loader-version.outputs.results }}
           github_login: ${{ secrets.BROWSER_GITHUB_BOT_NAME }}
-          github_token: ${{ secrets.BROWSER_GITHUB_BOT_PAT }}
           github_email: ${{ secrets.BROWSER_GITHUB_BOT_EMAIL }}
+          nr_docs_github_token: ${{ secrets.BROWSER_GITHUB_BOT_DOCS_PAT }}
+          nr_forks_github_token: ${{ secrets.BROWSER_GITHUB_FORKS_BOT_DOCS_PAT }}
 
   # Notify the release repo of the new release
   notify-release-repo:
@@ -233,7 +234,7 @@ jobs:
       - name: Notify Release Repo
         uses: ./.github/actions/notify-repository
         with:
-          token: ${{ secrets.BROWSER_GITHUB_BOT_PAT }}
+          token: ${{ secrets.BROWSER_GITHUB_BOT_INTERNAL_PAT }}
           repo_owner: newrelic
           repo_name: newrelic-browser-agent-release
-          event_type: new_release
+          event_type: new_release

.github/workflows/release-please.yml

@@ -23,7 +23,7 @@ jobs:
       - uses: google-github-actions/release-please-action@v3
         with:
           release-type: node
-          token: ${{ secrets.BROWSER_GITHUB_BOT_PAT }}
+          token: ${{ secrets.BROWSER_GITHUB_BOT_INTERNAL_PAT }}
           pull-request-header: "When this PR is merged, a new tagged release will be created with the notes below."
           changelog-types: |
             [