From 58cc443bd3eaa5cdf58c5c177a6afdd4304f4845 Mon Sep 17 00:00:00 2001
From: Nicolas Grekas <nicolas.grekas@gmail.com>
Date: Mon, 6 Jun 2022 11:40:17 +0200
Subject: [PATCH] Require a personal access token to merge

---
 .github/workflows/callable-qa.yml | 9 ++++++---
 .github/workflows/qa.yml          | 2 ++
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/callable-qa.yml b/.github/workflows/callable-qa.yml
index e11d220b..a9720859 100644
--- a/.github/workflows/callable-qa.yml
+++ b/.github/workflows/callable-qa.yml
@@ -3,6 +3,9 @@ name: Q&A
 on:
     workflow_call:
         inputs:
+            token:
+                required: true
+                type: string
             branch:
                 default: main
                 required: false
@@ -49,7 +52,7 @@ jobs:
                 name: Remove non-patched packages
                 if: "always() && steps.checkout.outcome == 'success'"
                 run: |
-                    .github/recipes-checker-main/run list-unpatched-packages $GITHUB_EVENT_PATH ${{ secrets.GITHUB_TOKEN }} | xargs -r -n10 rm -rf
+                    .github/recipes-checker-main/run list-unpatched-packages $GITHUB_EVENT_PATH ${{ inputs.token }} | xargs -r -n10 rm -rf
 
             -
                 name: Generate Flex testing endpoint
@@ -73,7 +76,7 @@ jobs:
                 if: "always() && steps.checkout.outcome == 'success'"
                 run: gh pr merge --auto --squash ${{ github.event.number }}
                 env:
-                    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                    GITHUB_TOKEN: ${{ inputs.token }}
 
             -
                 name: Compute diff between recipe versions
@@ -177,7 +180,7 @@ jobs:
                 name: Contribution is under MIT and has no merge commits
                 if: "always() && steps.checkout.outcome == 'success'"
                 run: |
-                    .github/recipes-checker-main/run lint:pull-request --license=MIT $GITHUB_EVENT_PATH ${{ secrets.GITHUB_TOKEN }}
+                    .github/recipes-checker-main/run lint:pull-request --license=MIT $GITHUB_EVENT_PATH ${{ inputs.token }}
 
             -
                 name: Parameters should be defined via the "container" configurator
diff --git a/.github/workflows/qa.yml b/.github/workflows/qa.yml
index cd010e1a..04d65be2 100644
--- a/.github/workflows/qa.yml
+++ b/.github/workflows/qa.yml
@@ -10,3 +10,5 @@ defaults:
 jobs:
     call-qa:
         uses: symfony/recipes/.github/workflows/callable-qa.yml@main
+        with:
+            token: ${{ secrets.BOT_TOKEN }}