Use STS to create (or reopen) Typeshed sync PRs (#29425)

After the integration of security-reviews of PRs in #29056, the regular
typeshed sync workflow now gets stuck even when the workflow is manually
approved (see #29402) because the PR is created by github-actions[bot]
and this causes the security review workflow to fail to get the STS
token.

By opening (or re-opening) the typeshed sync PR with a token from STS,
this can be fixed. It also means the PR won't need approval anymore.

.github/secure-token-service.json

@@ -22,6 +22,14 @@
       "permissions": { "contents": "write", "workflows": "write" },
       "target": "ruff-security"
     },
+    {
+      "caller": "ruff",
+      "environment": "automations",
+      "caller_workflow": "sync_typeshed.yaml",
+      "on": ["schedule", "workflow_dispatch"],
+      "permissions": { "contents": "write", "pull_requests": "write" },
+      "target": "ruff"
+    },
     {
       "caller": "ruff",
       "environment": "automations",

.github/workflows/sync_typeshed.yaml

@@ -74,14 +74,16 @@ jobs:
     timeout-minutes: 20
     # Don't run the cron job on forks:
     if: ${{ github.repository == 'astral-sh/ruff' || github.event_name != 'schedule' }}
+    environment: automations
     permissions:
-      contents: write # to push back to the repository
+      contents: read
+      id-token: write # for STS
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         name: Checkout Ruff
         with:
           path: ruff
-          persist-credentials: true
+          persist-credentials: false
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         name: Checkout typeshed
         with:
@@ -124,10 +126,23 @@ jobs:
           cd ruff
           ./scripts/codemod_docstrings.sh
           git commit -am "Sync Linux docstrings" --allow-empty
+      - name: Get repository token
+        id: token
+        uses: open-security-tools/ost-simple-sts@9e012247e07c39080fb6a832dbfbcfeacebc19c4
+        with:
+          exchange-url: ${{ secrets.STS_API_URL }}/exchange
+          audience: ${{ secrets.STS_API_URL }}
+          repository: astral-sh/ruff
+          permissions: |
+            contents: write
       - name: Push the changes
         id: commit
         if: ${{ success() }}
-        run: git -C ruff push --force --set-upstream origin "${UPSTREAM_BRANCH}"
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+        run: |
+          gh auth setup-git
+          git -C ruff push --force --set-upstream origin "${UPSTREAM_BRANCH}"
 
   # Checkout the branch created by the sync job,
   # and sync all docstrings available on Windows that are not available on Linux.
@@ -143,13 +158,15 @@ jobs:
     # (https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#example-requiring-successful-dependent-jobs)
     if: ${{ github.repository == 'astral-sh/ruff' || github.event_name != 'schedule' }}
 
+    environment: automations
     permissions:
-      contents: write # to push back to the repository
+      contents: read
+      id-token: write # for STS
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         name: Checkout Ruff
         with:
-          persist-credentials: true
+          persist-credentials: false
           ref: ${{ env.UPSTREAM_BRANCH}}
       - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
@@ -166,10 +183,22 @@ jobs:
         env:
           FORCE_COLOR: 1
         run: ./scripts/codemod_docstrings.sh
+      - name: Get repository token
+        id: token
+        uses: open-security-tools/ost-simple-sts@9e012247e07c39080fb6a832dbfbcfeacebc19c4
+        with:
+          exchange-url: ${{ secrets.STS_API_URL }}/exchange
+          audience: ${{ secrets.STS_API_URL }}
+          repository: astral-sh/ruff
+          permissions: |
+            contents: write
       - name: Commit the changes
         if: ${{ steps.docstrings.outcome == 'success' }}
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
         run: |
           git commit -am "Sync Windows docstrings" --allow-empty
+          gh auth setup-git
           git push
 
   # - Checkout the branch created by the sync job.
@@ -188,13 +217,15 @@ jobs:
     # (https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#example-requiring-successful-dependent-jobs)
     if: ${{ github.repository == 'astral-sh/ruff' || github.event_name != 'schedule' }}
 
+    environment: automations
     permissions:
-      contents: write # to push back to the repository
+      contents: read
+      id-token: write # for STS
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         name: Checkout Ruff
         with:
-          persist-credentials: true
+          persist-credentials: false
           ref: ${{ env.UPSTREAM_BRANCH}}
       - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
@@ -233,11 +264,26 @@ jobs:
         run: |
           rm "${VENDORED_TYPESHED}/pyproject.toml"
           git commit -am "Remove pyproject.toml file"
+      - name: Get repository token
+        id: token
+        uses: open-security-tools/ost-simple-sts@9e012247e07c39080fb6a832dbfbcfeacebc19c4
+        with:
+          exchange-url: ${{ secrets.STS_API_URL }}/exchange
+          audience: ${{ secrets.STS_API_URL }}
+          repository: astral-sh/ruff
+          permissions: |
+            contents: write
       - name: Push synced changes upstream
         if: ${{ success() }}
-        run: git push
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+        run: |
+          gh auth setup-git
+          git push
       - name: Apply and push typeshed patches
         if: ${{ success() }}
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
         run: |
           git apply --directory="${VENDORED_TYPESHED}" crates/ty_vendored/typeshed_patches/*.patch
           git add "${VENDORED_TYPESHED}"
@@ -314,16 +360,16 @@ jobs:
     # update-snapshots is deliberately NOT included here: it shouldn't block PR creation if it fails or times out.
     if: ${{ always() && needs.sync.result == 'success' && needs.docstrings-windows.result == 'success' && needs.docstrings-macos.result == 'success' && (github.repository == 'astral-sh/ruff' || github.event_name != 'schedule') }}
 
+    environment: automations
     permissions:
-      contents: write # to push back to the repository
-      pull-requests: write # to create a PR
+      contents: read
+      id-token: write # for STS
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         name: Checkout Ruff
         if: ${{ needs.update-snapshots.outputs.artifact-id != '' }}
         with:
-          # Persist credentials so the later git push can authenticate.
-          persist-credentials: true
+          persist-credentials: false
           ref: ${{ needs.update-snapshots.outputs.base-sha }}
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         name: Download snapshot changes
@@ -331,10 +377,22 @@ jobs:
         with:
           name: typeshed-snapshot-updates
           path: ${{ runner.temp }}/snapshot-updates
+      - name: Get repository token
+        id: token
+        uses: open-security-tools/ost-simple-sts@9e012247e07c39080fb6a832dbfbcfeacebc19c4
+        with:
+          exchange-url: ${{ secrets.STS_API_URL }}/exchange
+          audience: ${{ secrets.STS_API_URL }}
+          repository: astral-sh/ruff
+          permissions: |
+            contents: write
+            pull_requests: write
       - name: Commit and push snapshot changes
         # Treat generated changes as unreviewed contributions, including when running CI.
         # Human review is required before merging.
         if: ${{ needs.update-snapshots.outputs.artifact-id != '' }}
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
         run: |
           git config --global user.name typeshedbot
           git config --global user.email '<>'
@@ -345,13 +403,18 @@ jobs:
             echo "No snapshot changes to commit"
           else
             git commit -m "Update snapshots"
+            gh auth setup-git
             git push origin "HEAD:${UPSTREAM_BRANCH}"
           fi
 
-      - name: Create a PR
+      - name: Create PR
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
         run: |
-          gh pr list --repo "${GITHUB_REPOSITORY}" --head "${UPSTREAM_BRANCH}" --json id --jq length | grep 1 && exit 0 # exit if there is existing pr
-          gh pr create --repo "${GITHUB_REPOSITORY}" --base main --head "${UPSTREAM_BRANCH}" --title "[ty] Sync vendored typeshed stubs" --body "Close and reopen this PR to trigger CI" --label "ty"
+          pr_number="$(gh pr list --repo "${GITHUB_REPOSITORY}" --base main --head "${UPSTREAM_BRANCH}" --json number --jq '.[0].number // empty')"
+          if [[ -z "${pr_number}" ]]; then
+            gh pr create --repo "${GITHUB_REPOSITORY}" --base main --head "${UPSTREAM_BRANCH}" --title "[ty] Sync vendored typeshed stubs" --body "" --label "ty"
+          fi
 
   create-issue-on-failure:
     name: Create an issue if the typeshed sync failed