GitHub App Token Setup for Galaxy Helm Chart Updates

github-app-token-setup.md

GitHub App Token Setup for Galaxy Helm Chart Updates

This document explains how to create a GitHub App token for the workflow that automatically creates PRs to update the Galaxy Helm chart when new Galaxy releases are tagged.

Why Use GitHub App Tokens?

GitHub App tokens are more secure than Personal Access Tokens (PATs) because they provide:

• Better Security: Scoped permissions, automatic token rotation
• Better Audit Trail: Actions appear as performed by the app
• No User Dependencies: Doesn't depend on individual user accounts
• Fine-grained Permissions: Only the exact permissions needed

Step 1: Create a GitHub App

1. Navigate to GitHub App creation:

   https://github.com/organizations/galaxyproject/settings/apps/new
   

   (Or go to Organization Settings → Developer settings → GitHub Apps → New GitHub App)

2. Configure the GitHub App:

   • App name: Galaxy Helm Chart Updater (or similar)
   • Homepage URL: https://github.com/galaxyproject/galaxy
   • Webhook: Uncheck "Active" (not needed for this use case)

Step 2: Set Repository Permissions

Configure these Repository permissions:

• Contents: Write (to create branches and commits)
• Pull requests: Write (to create PRs)
• Metadata: Read (basic repository access)

Organization permissions: None needed Account permissions: None needed

Step 3: Install the App

1. After creating the app, click "Install App" in the left sidebar
2. Choose installation target: galaxyproject organization
3. Repository access: Select "Only select repositories"
4. Choose repositories: galaxy-helm (the target repository)

Step 4: Get App Credentials

1. Get App ID: Found on the app's general settings page
2. Generate Private Key:
   • Scroll down to "Private keys" section
   • Click "Generate a private key"
   • Download the .pem file

Step 5: Add Secrets to Galaxy Repository

Add these secrets to galaxyproject/galaxy:

# Go to: https://github.com/galaxyproject/galaxy/settings/secrets/actions

APP_ID: 123456  # Your app ID number
PRIVATE_KEY: |  # Content of the .pem file
  -----BEGIN RSA PRIVATE KEY-----
  MIIEpAIBAAKCAQEA...
  [full private key content]
  ...
  -----END RSA PRIVATE KEY-----

Step 6: Update the Workflow

Replace the PR creation section in .github/workflows/build_container_image.yaml:

pr:
  name: Create a PR to update the Galaxy Helm chart when a release is tagged
  runs-on: ubuntu-latest
  needs: [smoke-test, build]
  if: startsWith(github.ref, 'refs/tags/')
  steps:
    - name: Generate GitHub App Token
      id: generate_token
      uses: actions/create-github-app-token@v1
      with:
        app-id: ${{ secrets.APP_ID }}
        private-key: ${{ secrets.PRIVATE_KEY }}
        repositories: galaxy-helm

    - name: Checkout Galaxy Helm chart
      uses: actions/checkout@v6
      with:
        repository: galaxyproject/galaxy-helm
        token: ${{ steps.generate_token.outputs.token }}

    - name: Update Chart.yaml appVersion
      run: |
        sed -i "s/^appVersion:.*/appVersion: \"${{ needs.build.outputs.version }}\"/" galaxy/Chart.yaml

    - name: Update values.yaml image.tag
      run: |
        sed -i "s/^  tag:.*/  tag: \"${{ needs.build.outputs.tag }}\"/" galaxy/values.yaml

    - name: Create Pull Request
      uses: peter-evans/create-pull-request@v8
      with:
        token: ${{ steps.generate_token.outputs.token }}  # Use the generated token
        commit-message: "Update Galaxy to version ${{ needs.build.outputs.version }}"
        title: "Update Galaxy to version ${{ needs.build.outputs.version }}"
        body: |
          This PR updates the Galaxy Helm chart to use the new Galaxy release.

          Changes:
          - appVersion: ${{ needs.build.outputs.version }}
          - image.tag: ${{ needs.build.outputs.tag }}

          Triggered by: ${{ github.ref }}
        branch: update-galaxy-${{ needs.build.outputs.version }}
        delete-branch: true
        labels: patch

Current Issue Analysis

The workflow failure with "Git exit code 128" was caused by:

1. Missing or invalid GALAXY_HELM_PULL_REQUEST_TOKEN secret
2. Insufficient token permissions (needs contents: write and pull-requests: write on the galaxy-helm repo)
3. Credentials disabled by persist-credentials: false in the checkout action

Key Points

• The secret must be defined in the Galaxy repository (where the workflow runs)
• The token needs permissions for the Galaxy-Helm repository (where PRs are created)
• Cross-repository access pattern: secret in source repo, permissions for target repo
• GitHub Apps provide better security than Personal Access Tokens

Troubleshooting

If the workflow still fails after implementing these changes:

1. Verify app installation on the correct repository
2. Check app permissions match the requirements above
3. Validate private key format in the secret (including newlines)
4. Test token generation in a simple workflow first