App Token Cross Job

1name: Sync
2
3on:
4  workflow_dispatch:
5
6permissions: {}
7
8jobs:
9  prepare:
10    name: Prepare
11    runs-on: ubuntu-24.04
12    permissions:
13      contents: read
14      id-token: write
15    outputs:
16      gh_key: ${{ steps.secrets.outputs.GH-APP-KEY }}
17    steps:
18      - name: Log in to Azure
19        uses: bitwarden/gh-actions/azure-login@main
20        with:
21          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
22          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
23          client_id: ${{ secrets.AZURE_CLIENT_ID }}
24
25      - name: Get Azure Key Vault secrets
26        id: secrets
27        uses: bitwarden/gh-actions/get-keyvault-secrets@main
28        with:
29          keyvault: ci-shared-kv
30          secrets: "GH-APP-ID,GH-APP-KEY"
31
32      - name: Log out from Azure
33        uses: bitwarden/gh-actions/azure-logout@main
34
35  sync:
36    name: Sync downstream repo
37    needs: prepare
38    runs-on: ubuntu-24.04
39    permissions:
40      contents: read
41    steps:
42      - name: Check out platform repo
43        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
44        with:
45          repository: myorg/platform
46          token: ${{ needs.prepare.outputs.gh_key }}
47
48      - name: Trigger downstream sync
49        env:
50          GH_TOKEN: ${{ needs.prepare.outputs.gh_key }}
51        run: gh api repos/myorg/platform/dispatches -f event_type=sync