test-app-commit.yml

name: Test App commit verification

on:
  push:
    branches:
      - suever/use-app-token-for-openapi-commits/devrel-144

permissions:
  contents: write

jobs:
  test-commit:
    runs-on: ubuntu-latest
    steps:
      - name: Generate GitHub App token
        id: app-token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ vars.MASSIVE_CLIENT_LIBRARY_AUTOMATION_APP_ID }}
          private-key: ${{ secrets.MASSIVE_CLIENT_LIBRARY_AUTOMATION_APP_PRIVATE_KEY }}

      - name: Checkout
        uses: actions/checkout@v4
        with:
          token: ${{ steps.app-token.outputs.token }}
          persist-credentials: true

      - name: Make verified test commit
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          # Local commit to package the tree and push objects to GitHub.
          git config user.name "bot"
          git config user.email "bot@noreply"
          echo "# Test commit $(date -u) — safe to delete" > .test-app-commit
          git add .test-app-commit
          git commit -m "test: verify GitHub App commit shows as Verified"
          git push

          # Re-create the commit through the API so GitHub marks it as verified.
          TREE=$(git rev-parse HEAD^{tree})
          PARENT=$(git rev-parse HEAD~1)
          VERIFIED_SHA=$(gh api "repos/${{ github.repository }}/git/commits" \
            --method POST \
            -f message="test: verify GitHub App commit shows as Verified" \
            -f tree="$TREE" \
            -f "parents[]=$PARENT" \
            --jq .sha)

          # Point the branch at the verified commit.
          BRANCH=$(git rev-parse --abbrev-ref HEAD)
          gh api "repos/${{ github.repository }}/git/refs/heads/$BRANCH" \
            --method PATCH \
            -f sha="$VERIFIED_SHA" \
            -f force=true