use PAT

.github/workflows/transfer-issues.yml

@@ -10,6 +10,9 @@ on:
       from_name:
         description: "the name of the mozilla/<from_name repository to transfer issues from"
         required: true
+      secret_name:
+        description: "the name of the secret containing the PAT for the repository to transfer issues to"
+        required: true
 
 permissions: write-all
 
@@ -25,30 +28,28 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - id: meta
-        if: github.event_name == 'workflow_dispatch'
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SECRET_NAME: ${{ inputs.secret_name }}
         shell: bash
         run: |
+          set -x
+
+          if ! gh secret list --json name --jq '.[] | .name' | grep -q "$SECRET_NAME"; then
+            echo "$SECRET_NAME does not exist."
+            exit 1
+          else
+            echo ${{ secrets[$SECRET_NAME]}} | gh auth login --with-token
+            gh auth status
+          fi
+
           if [[ ! "${{ env.ALLOWED_REPOS }}" =~ (^|,)"${{ inputs.from_name }}"(,|$) ]]; then
             echo "Invalid from_name "${{ inputs.from_name }}". Exiting..."
             exit 1
           fi
 
-          echo "from_repo=${{ github.server_url }}/${{ github.repository_owner }}/${{ inputs.from_name }}" >> $GITHUB_OUTPUT
-          echo "to_repo=${{ github.server_url }}/${{ github.repository }}" >> $GITHUB_OUTPUT
-          echo "repo_label=repository:${{ inputs.from_name }}" >> $GITHUB_OUTPUT
-
-      - name: Transfer
-        if: github.event_name == 'workflow_dispatch'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        shell: bash
-        run: |
-          set -x
-
-          gh auth status
+          from_repo="${{ github.server_url }}/${{ github.repository_owner }}/${{ inputs.from_name }}"
+          to_repo="${{ github.server_url }}/${{ github.repository }}"
+          repo_label="repository:${{ inputs.from_name }}"
 
           gh label clone ${{ steps.meta.outputs.from_repo }} -R ${{ steps.meta.outputs.to_repo }} --force
 
@@ -80,3 +81,12 @@ jobs:
           cat old-issues.txt
 
           cat new-issues.txt
+
+      - name: Delete secret
+        if: always()
+        shell: bash
+        run: |
+          if gh secret list --json name --jq '.[] | .name' | grep -q "$SECRET_NAME"; then
+            gh secret delete ${{ inputs.secret_name }}
+          fi
+