Use GitHub app for authentication

.github/workflows/scala-steward.yml

@@ -11,20 +11,20 @@ jobs:
     name: scala-steward
     runs-on: ubuntu-latest
     steps:
-      # This is necessary to ensure that the most up-to-date version of
-      # REPOSITORIES.md is used.
-      - uses: actions/checkout@v2
+      - name: Generate token
+        id: generate-token
+        uses: tibdex/github-app-token@v1
+        with:
+          app_id: 214238
+          private_key: ${{ secrets.SCALA_STEWARD_APP_PRIVATE_KEY }}
 
       - name: Execute Scala Steward
         uses: scala-steward-org/[email protected]
 
         with:
-          # A GitHub personal access token tied to a user that will create
-          # pull requests against your projects to update dependencies. More
-          # on this under the YAML snippet.
-          github-token: ${{ secrets.SCALA_STEWARD_GITHUB_TOKEN }}
-          # A Markdown file with a literal Markdown list of repositories
-          # Scala Steward should monitor.
-          repos-file: REPOSITORIES.md
-          author-email: [email protected]
-          author-name: Scala Steward
+          # Use the token generated by the previous step and the 
+          # Guardian Scala Steward GitHub App
+          github-token: ${{ steps.generate-token.outputs.token }}
+          # used for listing repositories
+          github-app-id: 214238
+          github-app-key: ${{ secrets.SCALA_STEWARD_APP_PRIVATE_KEY }}

README.md

@@ -1,11 +1,10 @@
 # scala-steward-public-repos
 _Configuration for the Guardian's in-house instance of Scala Steward, suitable for PUBLIC Guardian repos_
 
-If you have a **public** Guardian repo you'd like to scan with Scala Steward, **just add the repo to
-the list in [REPOSITORIES.md](REPOSITORIES.md)** - this repo (`scala-steward-public-repos`) is public,
+If you have a **public** Guardian repo you'd like to scan with Scala Steward, **request to [install the GitHub app](https://github.com/apps/gu-scala-steward-public-repos) on your repository** - this repo (`scala-steward-public-repos`) is public,
 so the GitHub Action minutes are [free](https://docs.github.com/en/billing/managing-billing-for-github-actions/about-billing-for-github-actions).
 
-The Scala Steward action in this repository is only setup with an access token for **public**
+The Scala Steward action in this repository should only be given access to **public**
 GitHub repos. If your repo is **private**, you will want to add it to
 https://github.com/guardian/scala-steward-private-repos - note that we pay for
 the GitHub Action minutes for scanning running from that repo, because it's private, but it