ci: use kangal bot for contributor approval workflows

2 files changed, 17 insertions, 10 deletions

diff --git a/.github/workflows/approve-contributor.yml b/.github/workflows/approve-contributor.yml
index bc68b4f0..ee1ee91a 100644
--- a/.github/workflows/approve-contributor.yml
+++ b/.github/workflows/approve-contributor.yml
@@ -9,18 +9,19 @@ jobs:
     if: ${{ !github.event.issue.pull_request }}
     runs-on: ubuntu-latest
     permissions:
-      contents: write
-      issues: write
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.repository.default_branch }}
+          persist-credentials: false
 
       - name: Add contributor to approved list
         id: update
         uses: actions/github-script@v9
         with:
+          github-token: ${{ secrets.KANGAL_GITHUB_TOKEN }}
           script: |
             const fs = require('fs');
 
@@ -79,17 +80,20 @@ jobs:
 
       - name: Commit and push
         if: steps.update.outputs.status == 'added'
+        env:
+          KANGAL_GITHUB_TOKEN: ${{ secrets.KANGAL_GITHUB_TOKEN }}
         run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git config user.name "kangal-bot"
+          git config user.email "285672167+kangal-bot@users.noreply.github.com"
           git add .github/APPROVED_CONTRIBUTORS
           git diff --staged --quiet || git commit -m "chore: approve contributor ${{ github.event.issue.user.login }}"
-          git push
+          git push "https://x-access-token:${KANGAL_GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" HEAD:${{ github.event.repository.default_branch }}
 
       - name: Comment on issue
         if: steps.update.outputs.status == 'added'
         uses: actions/github-script@v9
         with:
+          github-token: ${{ secrets.KANGAL_GITHUB_TOKEN }}
           script: |
             const issueAuthor = context.payload.issue.user.login;
             await github.rest.issues.createComment({
diff --git a/.github/workflows/approve-merged-contributor.yml b/.github/workflows/approve-merged-contributor.yml
index 7885172d..deeb8936 100644
--- a/.github/workflows/approve-merged-contributor.yml
+++ b/.github/workflows/approve-merged-contributor.yml
@@ -9,18 +9,19 @@ jobs:
     if: ${{ github.event.pull_request.merged == true }}
     runs-on: ubuntu-latest
     permissions:
-      contents: write
-      pull-requests: read
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.repository.default_branch }}
+          persist-credentials: false
 
       - name: Add merged contributor to approved list
         id: update
         uses: actions/github-script@v9
         with:
+          github-token: ${{ secrets.KANGAL_GITHUB_TOKEN }}
           script: |
             const fs = require('fs');
 
@@ -53,9 +54,11 @@ jobs:
 
       - name: Commit and push
         if: steps.update.outputs.status == 'added'
+        env:
+          KANGAL_GITHUB_TOKEN: ${{ secrets.KANGAL_GITHUB_TOKEN }}
         run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git config user.name "kangal-bot"
+          git config user.email "285672167+kangal-bot@users.noreply.github.com"
           git add .github/APPROVED_CONTRIBUTORS
           git diff --staged --quiet || git commit -m "chore: approve merged contributor ${{ github.event.pull_request.user.login }}"
-          git push
+          git push "https://x-access-token:${KANGAL_GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" HEAD:${{ github.event.repository.default_branch }}