ci: Replace Patroll tokens with get-token action

.github/workflows/create-update-issues.yaml

@@ -16,7 +16,31 @@ jobs:
         uses: actions/checkout@v5
       - name: Fetch tags
         run: git fetch --prune --unshallow --tags
-      - name: Create issues
-        run: ./scripts/create-update-issues.sh --no-dry-run
+      - name: Get extension token
+        id: extension-token
+        uses: MetaMask/github-tools/.github/actions/get-token@v1
+        with:
+          token-exchange-url: ${{ vars.TOKEN_EXCHANGE_URL }}
+          target-repository: 'MetaMask/metamask-extension'
+          permissions: |
+            contents: read
+            issues: write
+            metadata: read
+      - name: Create issues in extension repository
+        run: ./scripts/create-update-issues.sh --no-dry-run --extension
         env:
-          GH_TOKEN: ${{ secrets.CORE_CREATE_UPDATE_ISSUES_TOKEN }}
+          GH_TOKEN: ${{ steps.extension-token.outputs.token }}
+      - name: Get mobile token
+        id: mobile-token
+        uses: MetaMask/github-tools/.github/actions/get-token@v1
+        with:
+          token-exchange-url: ${{ vars.TOKEN_EXCHANGE_URL }}
+          target-repository: 'MetaMask/metamask-mobile'
+          permissions: |
+            contents: read
+            issues: write
+            metadata: read
+      - name: Create issues in mobile repository
+        run: ./scripts/create-update-issues.sh --no-dry-run --mobile
+        env:
+          GH_TOKEN: ${{ steps.mobile-token.outputs.token }}

.github/workflows/update-changelogs.yml

@@ -32,11 +32,27 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: ${{ github.event.issue.number || github.event.pull_request.number }}
 
-  is-release:
-    name: Determine whether this PR is a release PR
+  get-token:
+    name: Get access token
     needs: is-fork
     if: needs.is-fork.outputs.is-fork == 'false'
     runs-on: ubuntu-latest
+    outputs:
+      token: ${{ steps.get-token.outputs.token }}
+    steps:
+      - name: Get access token
+        id: get-token
+        uses: MetaMask/github-tools/.github/actions/get-token@v1
+        with:
+          token-exchange-url: ${{ vars.TOKEN_EXCHANGE_URL }}
+          permissions: |
+            contents: write
+            pull_requests: write
+
+  is-release:
+    name: Determine whether this PR is a release PR
+    needs: get-token
+    runs-on: ubuntu-latest
     environment: default-branch
     outputs:
       is-release: ${{ steps.is-release.outputs.IS_RELEASE }}
@@ -48,7 +64,7 @@ jobs:
       - name: Get pull request info
         id: pr-info
         env:
-          GH_TOKEN: ${{ secrets.UPDATE_CHANGELOG_TOKEN }}
+          GH_TOKEN: ${{ needs.get-token.outputs.token }}
           PR_NUMBER: ${{ github.event.issue.number || github.event.pull_request.number }}
         run: |
           gh pr view "$PR_NUMBER" \
@@ -86,7 +102,9 @@ jobs:
 
   react-to-comment:
     name: React to the comment
-    needs: is-release
+    needs:
+      - get-token
+      - is-release
     if: needs.is-release.outputs.is-release == 'true' && github.event_name == 'issue_comment'
     runs-on: ubuntu-latest
     environment: default-branch
@@ -104,12 +122,14 @@ jobs:
             -f content='+1'
         env:
           COMMENT_ID: ${{ github.event.comment.id }}
-          GH_TOKEN: ${{ secrets.UPDATE_CHANGELOG_TOKEN }}
+          GH_TOKEN: ${{ needs.get-token.outputs.token }}
           REPO: ${{ github.repository }}
 
   update-changelogs:
     name: Update changelogs
-    needs: is-release
+    needs:
+      - get-token
+      - is-release
     if: ${{ needs.is-release.outputs.is-release == 'true' }}
     runs-on: ubuntu-latest
     environment: default-branch
@@ -118,7 +138,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ needs.is-release.outputs.merge-base }}
-          token: ${{ secrets.UPDATE_CHANGELOG_TOKEN }}
+          token: ${{ needs.get-token.outputs.token }}
 
       - name: Detach HEAD (to prevent accidental pushes)
         run: git checkout --detach HEAD
@@ -206,7 +226,7 @@ jobs:
           UPDATE_CHANGELOGS_OUTCOME: ${{ steps.update-changelogs.outcome }}
           PR_NUMBER: ${{ github.event.issue.number || github.event.pull_request.number }}
         with:
-          github-token: ${{ secrets.UPDATE_CHANGELOG_TOKEN }}
+          github-token: ${{ needs.get-token.outputs.token }}
           script: |
             const {
               CHANGES_PUSHED,

scripts/create-update-issues.sh

@@ -12,13 +12,19 @@ print-usage() {
 Detects major-bumped packages in a release commit and creates tickets in clients
 that instructs engineers to upgrade to them.
 
-Usage: $0 [--ref REF] [--no-dry-run]
+Usage: $0 [--ref REF] [--no-dry-run] [--extension] [--mobile]
 
 OPTIONS:
 
 --ref REF, -r REF       The release commit to inspect.
 --no-dry-run            By default, this script won't do anything, to allow you
                         to test it. Pass this option to override that.
+--extension             Create issues only in the extension repo. If neither
+                        --extension nor --mobile is passed, issues are created
+                        in both repos.
+--mobile                Create issues only in the mobile repo. If neither
+                        --extension nor --mobile is passed, issues are created
+                        in both repos.
 --help, -h              You're looking at it ;)
 EOT
 }
@@ -126,6 +132,8 @@ main() {
   local exitcode=0
   local dry_run=1
   local ref="$DEFAULT_REF"
+  local create_extension=0
+  local create_mobile=0
 
   while [[ $# -gt 0 ]]; do
     case "$1" in
@@ -142,6 +150,14 @@ main() {
         dry_run=0
         shift
         ;;
+      --extension)
+        create_extension=1
+        shift
+        ;;
+      --mobile)
+        create_mobile=1
+        shift
+        ;;
       --help|-h)
         print-usage
         exit 0
@@ -155,6 +171,12 @@ main() {
     esac
   done
 
+  # Default to both repos if neither is specified
+  if [[ $create_extension -eq 0 && $create_mobile -eq 0 ]]; then
+    create_extension=1
+    create_mobile=1
+  fi
+
   if [[ -z "$ref" ]]; then
     echo "ERROR: Missing ref."
     echo "---------------------"
@@ -194,20 +216,24 @@ main() {
 
   echo
 
-  local all_issues_extension
-  echo "Fetching issues on $EXTENSION_REPO with label $DEFAULT_LABEL..."
-  if ! all_issues_extension="$(gh issue list --repo "$EXTENSION_REPO" --label "$DEFAULT_LABEL" --state all --json number,title,url 2>&1)"; then
-    echo "❌ Failed to fetch issues from ${EXTENSION_REPO}"
-    echo "$all_issues_extension"
-    exit 1
+  local all_issues_extension=""
+  if [[ $create_extension -eq 1 ]]; then
+    echo "Fetching issues on $EXTENSION_REPO with label $DEFAULT_LABEL..."
+    if ! all_issues_extension="$(gh issue list --repo "$EXTENSION_REPO" --label "$DEFAULT_LABEL" --state all --json number,title,url 2>&1)"; then
+      echo "❌ Failed to fetch issues from ${EXTENSION_REPO}"
+      echo "$all_issues_extension"
+      exit 1
+    fi
   fi
 
-  local all_issues_mobile
-  echo "Fetching issues on $MOBILE_REPO with label $DEFAULT_LABEL..."
-  if ! all_issues_mobile="$(gh issue list --repo "$MOBILE_REPO" --label "$DEFAULT_LABEL" --state all --json number,title,url 2>&1)"; then
-    echo "❌ Failed to fetch issues from ${MOBILE_REPO}"
-    echo "$all_issues_mobile"
-    exit 1
+  local all_issues_mobile=""
+  if [[ $create_mobile -eq 1 ]]; then
+    echo "Fetching issues on $MOBILE_REPO with label $DEFAULT_LABEL..."
+    if ! all_issues_mobile="$(gh issue list --repo "$MOBILE_REPO" --label "$DEFAULT_LABEL" --state all --json number,title,url 2>&1)"; then
+      echo "❌ Failed to fetch issues from ${MOBILE_REPO}"
+      echo "$all_issues_mobile"
+      exit 1
+    fi
   fi
 
   for tag in "${tag_array[@]}"; do
@@ -233,29 +259,33 @@ main() {
     fi
 
     # Create the extension issue, if it doesn't exist yet
-    echo
-    echo "Checking for existing issues in ${EXTENSION_REPO}..."
-    if existing-issue-found "${EXTENSION_REPO}" "$package_name" "$version" "$all_issues_extension"; then
-      if [[ $dry_run -eq 1 ]]; then
-        echo "⏭️ Would not have created issue because it already exists"
-      else
-        echo "⏭️ Not creating issue because it already exists"
+    if [[ $create_extension -eq 1 ]]; then
+      echo
+      echo "Checking for existing issues in ${EXTENSION_REPO}..."
+      if existing-issue-found "${EXTENSION_REPO}" "$package_name" "$version" "$all_issues_extension"; then
+        if [[ $dry_run -eq 1 ]]; then
+          echo "⏭️ Would not have created issue because it already exists"
+        else
+          echo "⏭️ Not creating issue because it already exists"
+        fi
+      elif ! create-issue "$dry_run" "$EXTENSION_REPO" "$package_name" "$version" "$team_labels"; then
+        exitcode=1
       fi
-    elif ! create-issue "$dry_run" "$EXTENSION_REPO" "$package_name" "$version" "$team_labels"; then
-      exitcode=1
     fi
 
     # Create the mobile issue, if it doesn't exist yet
-    echo
-    echo "Checking for existing issues in ${MOBILE_REPO}..."
-    if existing-issue-found "${MOBILE_REPO}" "$package_name" "$version" "$all_issues_mobile"; then
-      if [[ $dry_run -eq 1 ]]; then
-        echo "⏭️ Would not have created issue because it already exists"
-      else
-        echo "⏭️ Not creating issue because it already exists"
+    if [[ $create_mobile -eq 1 ]]; then
+      echo
+      echo "Checking for existing issues in ${MOBILE_REPO}..."
+      if existing-issue-found "${MOBILE_REPO}" "$package_name" "$version" "$all_issues_mobile"; then
+        if [[ $dry_run -eq 1 ]]; then
+          echo "⏭️ Would not have created issue because it already exists"
+        else
+          echo "⏭️ Not creating issue because it already exists"
+        fi
+      elif ! create-issue "$dry_run" "$MOBILE_REPO" "$package_name" "$version" "$team_labels"; then
+        exitcode=1
       fi
-    elif ! create-issue "$dry_run" "$MOBILE_REPO" "$package_name" "$version" "$team_labels"; then
-      exitcode=1
     fi
   done