From d0e29815656a3f711613ac948ba4536578cb6016 Mon Sep 17 00:00:00 2001 From: cb-logesh Date: Thu, 3 Sep 2026 19:31:12 +0530 Subject: [PATCH] ci: point the dispatch at the dedicated Postman app Swaps CB_SDK_BOT_APP_ID / CB_SDK_BOT_PEM_KEY for the dedicated app's POSTMAN_DISPATCH_APP_ID / POSTMAN_DISPATCH_PEM_KEY. The app is installed on chargebee/cb-openapi-generator alone with Contents: write, per the #ask-cloud guidance to use an app rather than a rotating personal access token. --- .github/workflows/notify-postman.yml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/.github/workflows/notify-postman.yml b/.github/workflows/notify-postman.yml index 5c5fa1e..c9f2d4c 100644 --- a/.github/workflows/notify-postman.yml +++ b/.github/workflows/notify-postman.yml @@ -31,9 +31,10 @@ jobs: notify: runs-on: ubuntu-latest steps: - # Same identity cb-sdk-gen releases specs with (chargebee-sdk-release-bot), - # so no separate personal access token needs minting or rotating: the - # installation token below lives for an hour. + # Dedicated GitHub App, installed on chargebee/cb-openapi-generator alone + # with Contents: write — the single permission repository_dispatch needs. + # No personal access token to mint or rotate: the installation token + # below lives for an hour. # # continue-on-error is what keeps this workflow failing soft. Without it # this step hard-fails when the private key is absent or malformed, before @@ -46,8 +47,8 @@ jobs: continue-on-error: true uses: actions/create-github-app-token@v1 with: - app-id: ${{ secrets.CB_SDK_BOT_APP_ID }} - private-key: ${{ secrets.CB_SDK_BOT_PEM_KEY }} + app-id: ${{ secrets.POSTMAN_DISPATCH_APP_ID }} + private-key: ${{ secrets.POSTMAN_DISPATCH_PEM_KEY }} owner: ${{ github.repository_owner }} repositories: cb-openapi-generator permission-contents: write