ci: use cloud-code-bot for the dispatch token

FEN_RELEASE_* are environment secrets on the 'backport release'
environment, which is gated on required reviewers. A tag dispatch must
not wait on a human approval, so that environment is not usable here.

cloud-code-bot already authors the bump PRs on the cloud side, so its
write access to Comfy-Org/cloud is established.
This commit is contained in:
Matt Miller
2026-07-28 14:47:08 -07:00
parent 2c40b09059
commit fefe6420a7

View File

@@ -22,10 +22,14 @@ jobs:
id: app-token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
with:
app-id: ${{ secrets.FEN_RELEASE_APP_ID }}
private-key: ${{ secrets.FEN_RELEASE_PRIVATE_KEY }}
# Cross-repo dispatch: without these the token is scoped to this
# repository and the POST to cloud would 403.
# cloud-code-bot is the same App the cloud receiver already runs on:
# it authored the bump PRs, so its write access there is established
# rather than assumed.
app-id: ${{ vars.CLOUD_CODE_BOT_APP_ID }}
private-key: ${{ secrets.CLOUD_CODE_BOT_PRIVATE_KEY }}
# Cross-repo dispatch: create-github-app-token scopes to the current
# repository by default, so the org installation must be named
# explicitly or the POST to cloud would 403.
owner: Comfy-Org
repositories: cloud