fix(issue-bot): add permissions, remove secrets

Author: northword

.github/workflows/issue-bot.yml

@@ -103,15 +103,15 @@ on:
         required: false
         default: "keep-open"
 
-    secrets:
-      github-token:
-        description: "GITHUB_TOKEN for API requests."
-        required: true
+    # secrets:
+    #   github-token:
+    #     description: "GITHUB_TOKEN for API requests."
+    #     required: true
 
 permissions:
   issues: write
   pull-requests: write
-  discussions: write
+  # discussions: write
 
 jobs:
   feedback:
@@ -123,15 +123,15 @@ jobs:
         uses: actions-cool/issues-helper@v3
         with:
           actions: add-labels
-          token: ${{ secrets.github-token }}
+          token: ${{ secrets.GITHUB_TOKEN }}
           issue-number: ${{ github.event.issue.number }}
           labels: ${{ inputs.feedback-label }}
       - name: Remove "feedback" label
         if: ${{ !contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association) }}
         uses: actions-cool/issues-helper@v3
         with:
           actions: remove-labels
-          token: ${{ secrets.github-token }}
+          token: ${{ secrets.GITHUB_TOKEN }}
           issue-number: ${{ github.event.issue.number }}
           labels: ${{ inputs.feedback-label }}
 
@@ -143,7 +143,7 @@ jobs:
       - uses: actions-cool/issues-helper@v3
         with:
           actions: close-issue, create-comment
-          token: ${{ secrets.github-token }}
+          token: ${{ secrets.GITHUB_TOKEN }}
           body: ${{ inputs.invalid-label-comment }}
 
   duplicate:
@@ -154,7 +154,7 @@ jobs:
       - uses: actions-cool/issues-helper@v3
         with:
           actions: mark-duplicate
-          token: ${{ secrets.github-token }}
+          token: ${{ secrets.GITHUB_TOKEN }}
           labels: ${{ inputs.duplicate-label }}
           close-issue: ${{ inputs.close-duplicates }}
 
@@ -169,7 +169,7 @@ jobs:
       - name: Close stale issues
         uses: actions/stale@v10
         with:
-          repo-token: ${{ secrets.github-token }}
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
           only-labels: ${{ inputs.stale-check-only-labels }}
           days-before-issue-stale: ${{ inputs.days-before-issue-stale }}
           days-before-issue-close: ${{ inputs.days-before-issue-close }}
@@ -190,7 +190,7 @@ jobs:
       - name: Lock closed threads
         uses: dessant/lock-threads@v5
         with:
-          github-token: ${{ secrets.github-token }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
           issue-inactive-days: ${{ inputs.issue-inactive-days-before-lock }}
           exclude-any-issue-labels: ${{ inputs.exclude-lock-issue-labels }}
           pr-inactive-days: 30

README.md

@@ -38,7 +38,7 @@ on:
 
 jobs:
   issue-bot:
-    uses: zotero-plugin-dev/workflows/.github/workflows/issue-bot.yml
+    uses: zotero-plugin-dev/workflows/.github/workflows/issue-bot.yml@main
     secrets:
       github-token: ${{ secrets.GITHUB_TOKEN }}
 

examples/issue-bot.yml

@@ -11,8 +11,12 @@ on:
     - cron: "30 1 * * *"
   workflow_dispatch:
 
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   issue-bot:
-    uses: zotero-plugin-dev/workflows/.github/workflows/issue-bot.yml
+    uses: zotero-plugin-dev/workflows/.github/workflows/issue-bot.yml@main
     secrets:
       github-token: ${{ secrets.GITHUB_TOKEN }}