ci: use github app to commit changes in workflow

Author: choffmann

.github/workflows/build-and-push-stage.yml

@@ -11,9 +11,11 @@ jobs:
   build_and_deploy_stage:
     runs-on: ubuntu-latest
     permissions:
-      contents: write
       packages: write
       actions: write
+    outputs:
+      branch: ${{ steps.extract_branch.outputs.branch }}
+      version: ${{ env.RELEASE_VERSION }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -80,25 +82,54 @@ jobs:
           push: true
           tags: ghcr.io/${{ env.REPO_LC }}:${{ env.RELEASE_VERSION }},ghcr.io/${{ env.REPO_LC }}:${{ env.COMMIT_SHA }}
 
+  update_deployment:
+    runs-on: ubuntu-latest
+    needs: build_and_deploy_stage
+    permissions:
+      contents: write
+    env:
+      branch: ${{ needs.build_and_deploy_stage.outputs.branch }}
+      version: ${{ needs.build_and_deploy_stage.outputs.version }}
+    steps:
+      - uses: actions/create-github-app-token@v2
+        id: app-token
+        with:
+          app-id: ${{ vars.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
+
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          fetch-depth: 0
+          fetch-tags: true
+
       - name: 'Setup yq'
         uses: dcarbone/install-yq-action@v1.3.1
         with:
           version: 'v4.44.3'
           force: true
 
+      - name: Bump version in values/stage.yaml
+        run: yq -i '.deployment.image.tag=strenv(version)' ./k8s/values/stage.yaml
+
+      - name: Get GitHub App User ID
+        id: get-user-id
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
+
       - name: Initialize mandatory git config
         run: |
-          git config --global user.name 'GitHub Actions'
-          git config --global user.email 'noreply@github.com'
-
-      - name: Bump version in values/stage.yaml
-        run: yq -i '.deployment.image.tag=strenv(RELEASE_VERSION)' ./k8s/values/stage.yaml
+          git config --global user.name '${{ steps.app-token.outputs.app-slug }}[bot]'
+          git config --global user.email '${{ steps.get-user-id.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com'
 
       - name: Commit k8s values and push changes
         env:
-          GITHUB_TOKEN: ${{ secrets.GREEN_ECOLUTION_PAT }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           git add ./k8s/values/stage.yaml
-          git commit --message "chore: update stage image to version ${{ env.RELEASE_VERSION }}" \
+          git commit --message "chore: update stage image to version ${{ env.RELEASE_VERSION }} [skip ci]" \
             && git push origin ${{ steps.extract_branch.outputs.branch }} \
             || echo "No changes to commit"