Remove api commit from version bump

.github/workflows/build-cli-docker.yml

@@ -51,12 +51,21 @@ jobs:
       - name: Login to Azure ACR
         run: az acr login -n "${_AZ_REGISTRY%.azurecr.io}"
 
-      - name: Retrieve github PAT secrets
-        id: retrieve-secret-pat
+      - name: Retrieve GH App secrets
+        id: retrieve-secret
         uses: bitwarden/gh-actions/get-keyvault-secrets@main
         with:
-          keyvault: "bitwarden-ci"
-          secrets: "github-pat-bitwarden-devops-bot-repo-scope"
+          keyvault: gh-org-bitwarden
+          secrets: "BW-GHAPP-ID,BW-GHAPP-KEY"
+
+      - name: Generate GH App token
+        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+        id: app-token
+        with:
+          app-id: ${{ steps.retrieve-secret.outputs.BW-GHAPP-ID }}
+          private-key: ${{ steps.retrieve-secret.outputs.BW-GHAPP-KEY }}
+          owner: ${{ github.repository_owner }}
+          permission-contents: read
 
       - name: Setup Docker Trust
         if: ${{ env.is_publish_branch == 'true' }}
@@ -99,7 +108,7 @@ jobs:
           push: true
           tags: ${{ steps.tag-list.outputs.tags }}
           secrets: |
-            "GH_PAT=${{ steps.retrieve-secret-pat.outputs.github-pat-bitwarden-devops-bot-repo-scope }}"
+            "GH_PAT=${{ steps.app-token.outputs.token }}"
           cache-from: type=gha
           cache-to: type=gha,mode=max
 

.github/workflows/publish-php.yml

@@ -82,6 +82,8 @@ jobs:
       id-token: write
     env:
       _PKG_VERSION: ${{ needs.validate.outputs.version }}
+      _BOT_NAME: "bw-ghapp[bot]"
+      _BOT_EMAIL: "178206702+bw-ghapp[bot]@users.noreply.github.com"
     steps:
       - name: Checkout SDK repo
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
@@ -151,21 +153,25 @@ jobs:
       - name: Commit changes
         if: ${{ inputs.release_type != 'Dry Run' }}
         id: commit
-        uses: bitwarden/gh-actions/api-commit@main
-        with:
-          token: ${{ steps.app-token.outputs.token }}
-          branch: main
-          message: "Update PHP SDK to ${{ github.sha }}"
-          repo: sm-sdk-php
-          owner: bitwarden
+        working-directory: sm-sdk-php
+        env:
+          MESSAGE: "Update PHP SDK to ${{ github.sha }}"
+        run: |
+          git config user.name  "$_BOT_NAME"
+          git config user.email "$_BOT_EMAIL"
+          git add -A
+          if git diff --staged --quiet; then
+            echo "No changes to commit"
+            exit 0
+          fi
+          git commit -m "$MESSAGE"
+          git push origin main
 
       - name: Create release tag on PHP SDK repo
         if: ${{ inputs.release_type != 'Dry Run' }}
         working-directory: sm-sdk-php
         run: |
-          # Sync local repo with API-created commit
-          git fetch origin main
-          git checkout FETCH_HEAD
+          # Local repo already has the commit we just pushed; no fetch/checkout needed.
 
           # Check if tag exists, set output then exit 0 if true.
           if git log "v${_PKG_VERSION}" >/dev/null 2>&1; then

.github/workflows/release-go.yml

@@ -58,6 +58,8 @@ jobs:
       id-token: write
     env:
       _PKG_VERSION: ${{ needs.validate.outputs.version }}
+      _BOT_NAME: "bw-ghapp[bot]"
+      _BOT_EMAIL: "178206702+bw-ghapp[bot]@users.noreply.github.com"
 
     steps:
       - name: Checkout SDK repo
@@ -183,21 +185,25 @@ jobs:
 
       - name: Commit changes
         if: ${{ inputs.release_type != 'Dry Run' }}
-        uses: bitwarden/gh-actions/api-commit@main
-        with:
-          token: ${{ steps.app-token.outputs.token }}
-          branch: main
-          message: "Update Go SDK to ${{ github.sha }}"
-          repo: sdk-go
-          owner: bitwarden
+        working-directory: sdk-go
+        env:
+          MESSAGE: "Update Go SDK to ${{ github.sha }}"
+        run: |
+          git config user.name  "$_BOT_NAME"
+          git config user.email "$_BOT_EMAIL"
+          git add -A
+          if git diff --staged --quiet; then
+            echo "No changes to commit"
+            exit 0
+          fi
+          git commit -m "$MESSAGE"
+          git push origin main
 
       - name: Create release tag on SDK Go repo
         if: ${{ inputs.release_type != 'Dry Run' }}
         working-directory: sdk-go
         run: |
-          # Sync local repo with API-created commit
-          git fetch origin main
-          git checkout FETCH_HEAD
+          # Local repo already has the commit we just pushed; no fetch/checkout needed.
 
           # Check if tag exists, set output then exit 0 if true.
           if git log "v${_PKG_VERSION}" >/dev/null 2>&1; then

.github/workflows/version-bump.yml

@@ -39,6 +39,8 @@ jobs:
     env:
       _VERSION: ${{ inputs.version_number }}
       _PROJECT: ${{ inputs.project }}
+      _BOT_NAME: "bw-ghapp[bot]"
+      _BOT_EMAIL: "178206702+bw-ghapp[bot]@users.noreply.github.com"
     steps:
       - name: Install rust
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
@@ -87,6 +89,11 @@ jobs:
           persist-credentials: true
           token: ${{ steps.app-token.outputs.token }}
 
+      - name: Configure git
+        run: |
+          git config user.name  "$_BOT_NAME"
+          git config user.email "$_BOT_EMAIL"
+
       - name: Create Version Branch
         id: create-branch
         run: |
@@ -225,13 +232,13 @@ jobs:
 
       - name: Commit files
         if: ${{ steps.version-changed.outputs.changes_to_commit == 'TRUE' }}
-        uses: bitwarden/gh-actions/api-commit@main
-        with:
-          token: ${{ steps.app-token.outputs.token }}
-          branch: ${{ steps.create-branch.outputs.name }}
-          message: "Bumped sdk-${{ inputs.project }} version to ${{ inputs.version_number }}"
-          repo: sdk-sm
-          owner: bitwarden
+        env:
+          BRANCH: ${{ steps.create-branch.outputs.name }}
+          MESSAGE: "Bumped sdk-${{ inputs.project }} version to ${{ inputs.version_number }}"
+        run: |
+          git add -A
+          git commit -m "$MESSAGE"
+          git push origin "$BRANCH"
 
       - name: Create Version PR
         if: ${{ steps.version-changed.outputs.changes_to_commit == 'TRUE' }}