From 676bfce7e10f4c1cb48ee965344c023ac0ae767d Mon Sep 17 00:00:00 2001
From: Alexander Wang <alex@d2lang.com>
Date: Mon, 3 Aug 2026 10:24:46 -0700
Subject: [PATCH] replace legacy CI credentials

---
 .github/workflows/ci.yml    | 11 ++++++++---
 .github/workflows/daily.yml |  5 ++++-
 lib.sh                      | 11 ++---------
 lib/git.sh                  | 11 ++---------
 4 files changed, 16 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 40f1752..6d51427 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,25 +7,30 @@ concurrency:
 jobs:
   ci:
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
     steps:
       - uses: actions/checkout@v3
       - run: COLOR=1 ./ci/ci.sh
         env:
-          GITHUB_TOKEN: ${{ secrets._GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
   nofixups:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v3
       - run: COLOR=1 ./bin/nofixups.sh
         env:
-          GITHUB_TOKEN: ${{ secrets._GITHUB_TOKEN }}
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
   signed:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v3
       - run: COLOR=1 ./bin/ensure_signed.sh
         env:
-          GITHUB_TOKEN: ${{ secrets._GITHUB_TOKEN }}
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml
index 4894221..be31132 100644
--- a/.github/workflows/daily.yml
+++ b/.github/workflows/daily.yml
@@ -10,9 +10,12 @@ concurrency:
 jobs:
   ci:
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
     steps:
       - uses: actions/checkout@v3
       - run: COLOR=1 CI_FORCE=1 ./ci/ci.sh
         env:
-          GITHUB_TOKEN: ${{ secrets._GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
diff --git a/lib.sh b/lib.sh
index 88983f6..da5d74f 100644
--- a/lib.sh
+++ b/lib.sh
@@ -361,13 +361,6 @@ git_commit_count() {
   (git rev-list HEAD --count 2>/dev/null) || echo 0
 }
 
-configure_github_token() {
-  git config --global credential.helper store
-  cat > ~/.git-credentials <<EOF
-https://cyborg-ts:$GITHUB_TOKEN@github.com
-EOF
-}
-
 git_pure() {
   if [ -z "${GIT_CONFIG_PURE-}" ]; then
     GIT_CONFIG_PURE="$(mktempd)/gitconfig-pure"
@@ -381,8 +374,8 @@ git_pure() {
       GIT_CONFIG_GLOBAL=$GIT_CONFIG_PURE command git config --global pager.diff 'diff-highlight | less'
     fi
     GIT_CONFIG_GLOBAL=$GIT_CONFIG_PURE command git config --global init.defaultBranch master
-    GIT_CONFIG_GLOBAL=$GIT_CONFIG_PURE command git config --global user.name "Cyborg Tstruct"
-    GIT_CONFIG_GLOBAL=$GIT_CONFIG_PURE command git config --global user.email "info+cyborg@terrastruct.com"
+    GIT_CONFIG_GLOBAL=$GIT_CONFIG_PURE command git config --global user.name "D2 CI"
+    GIT_CONFIG_GLOBAL=$GIT_CONFIG_PURE command git config --global user.email "ci@d2lang.com"
     export _GIT_CONFIG_PURE=1
   fi
   GIT_CONFIG_GLOBAL=$GIT_CONFIG_PURE gitc "$@"
diff --git a/lib/git.sh b/lib/git.sh
index 92ebbc1..77b0d6f 100644
--- a/lib/git.sh
+++ b/lib/git.sh
@@ -203,13 +203,6 @@ git_commit_count() {
   (git rev-list HEAD --count 2>/dev/null) || echo 0
 }
 
-configure_github_token() {
-  git config --global credential.helper store
-  cat > ~/.git-credentials <<EOF
-https://cyborg-ts:$GITHUB_TOKEN@github.com
-EOF
-}
-
 git_pure() {
   if [ -z "${GIT_CONFIG_PURE-}" ]; then
     GIT_CONFIG_PURE="$(mktempd)/gitconfig-pure"
@@ -223,8 +216,8 @@ git_pure() {
       GIT_CONFIG_GLOBAL=$GIT_CONFIG_PURE command git config --global pager.diff 'diff-highlight | less'
     fi
     GIT_CONFIG_GLOBAL=$GIT_CONFIG_PURE command git config --global init.defaultBranch master
-    GIT_CONFIG_GLOBAL=$GIT_CONFIG_PURE command git config --global user.name "Cyborg Tstruct"
-    GIT_CONFIG_GLOBAL=$GIT_CONFIG_PURE command git config --global user.email "info+cyborg@terrastruct.com"
+    GIT_CONFIG_GLOBAL=$GIT_CONFIG_PURE command git config --global user.name "D2 CI"
+    GIT_CONFIG_GLOBAL=$GIT_CONFIG_PURE command git config --global user.email "ci@d2lang.com"
     export _GIT_CONFIG_PURE=1
   fi
   GIT_CONFIG_GLOBAL=$GIT_CONFIG_PURE gitc "$@"