chore: use fine-grained gh token

.github/workflows/docker.yml

@@ -12,7 +12,7 @@ concurrency:
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
-  GITHUB_API_TOKEN: ${{ secrets.MY_RELEASE_PLEASE_TOKEN || github.token }}
+  GITHUB_API_TOKEN: ${{ secrets.MISE_GH_TOKEN || github.token }}
 
 jobs:
   docker:

.github/workflows/docs.yml

@@ -20,7 +20,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  GITHUB_TOKEN: ${{ secrets.MY_RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
+  GITHUB_TOKEN: ${{ secrets.MISE_GH_TOKEN || secrets.GITHUB_TOKEN }}
 
 jobs:
   docs:

.github/workflows/hyperfine.yml

@@ -13,7 +13,7 @@ concurrency:
 
 env:
   CARGO_TERM_COLOR: always
-  GITHUB_TOKEN: ${{ secrets.MY_RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
+  GITHUB_TOKEN: ${{ secrets.MISE_GH_TOKEN || secrets.GITHUB_TOKEN }}
   MISE_EXPERIMENTAL: 1
 
 permissions:

.github/workflows/registry.yml

@@ -21,7 +21,7 @@ env:
   MISE_EXPERIMENTAL: 1
   MISE_LOCKFILE: 1
   RUST_BACKTRACE: 1
-  GITHUB_TOKEN: ${{ secrets.MY_RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
+  GITHUB_TOKEN: ${{ secrets.MISE_GH_TOKEN || secrets.GITHUB_TOKEN }}
 
 jobs:
   build:

.github/workflows/release-alpine.yml

@@ -16,9 +16,9 @@ concurrency:
 
 env:
   DRY_RUN: ${{ github.event_name == 'release' && '0' || (github.event_name == 'workflow_dispatch' && (github.event.inputs.dry_run && '1' || '0')) || '1' }}
-  GITHUB_API_TOKEN: ${{ secrets.MY_RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
-  GITHUB_TOKEN: ${{ secrets.MY_RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
-  GH_TOKEN: ${{ secrets.MY_RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
+  GITHUB_API_TOKEN: ${{ secrets.MISE_GH_TOKEN || secrets.GITHUB_TOKEN }}
+  GITHUB_TOKEN: ${{ secrets.MISE_GH_TOKEN || secrets.GITHUB_TOKEN }}
+  GH_TOKEN: ${{ secrets.MISE_GH_TOKEN || secrets.GITHUB_TOKEN }}
 
 jobs:
   bump-alpine:

.github/workflows/release-fig.yml

@@ -13,7 +13,7 @@ jobs:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.MY_RELEASE_PLEASE_TOKEN }}
+          token: ${{ secrets.MISE_GH_TOKEN }}
       - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2
         with:
           shared-key: build
@@ -32,7 +32,7 @@ jobs:
       - name: Create Autocomplete PR ## Create the autocomplete PR using this action
         uses: withfig/push-to-fig-autocomplete-action@fb320c27ec12b225b9446373aa30b7d9c0c1eae8 # v2
         with:
-          token: ${{ secrets.MY_RELEASE_PLEASE_TOKEN }}
+          token: ${{ secrets.MISE_GH_TOKEN }}
           autocomplete-spec-name: mise
           spec-path: tasks/fig/src/mise.ts
           pr-body: "Automated PR for latest mise release by https://github.com/jdx/mise"

.github/workflows/release-plz.yml

@@ -20,7 +20,7 @@ env:
   NPM_CONFIG_FUND: false
   RUST_BACKTRACE: 1
   CARGO_TERM_COLOR: always
-  GITHUB_TOKEN: ${{ secrets.MY_RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
+  GITHUB_TOKEN: ${{ secrets.MISE_GH_TOKEN || secrets.GITHUB_TOKEN }}
 
 jobs:
   release-plz:
@@ -31,7 +31,7 @@ jobs:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.MY_RELEASE_PLEASE_TOKEN }}
+          token: ${{ secrets.MISE_GH_TOKEN }}
       - uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6
         with:
           gpg_private_key: ${{ secrets.MISE_GPG_KEY }}

.github/workflows/release.yml

@@ -13,9 +13,9 @@ env:
   CARGO_TERM_COLOR: always
   DRY_RUN: ${{ startsWith(github.event.ref, 'refs/tags/v') && '0' || '1' }}
   RUST_BACKTRACE: 1
-  GITHUB_API_TOKEN: ${{ secrets.MY_RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
-  GITHUB_TOKEN: ${{ secrets.MY_RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
-  GH_TOKEN: ${{ secrets.MY_RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
+  GITHUB_API_TOKEN: ${{ secrets.MISE_GH_TOKEN || secrets.GITHUB_TOKEN }}
+  GITHUB_TOKEN: ${{ secrets.MISE_GH_TOKEN || secrets.GITHUB_TOKEN }}
+  GH_TOKEN: ${{ secrets.MISE_GH_TOKEN || secrets.GITHUB_TOKEN }}
 
 jobs:
   build-tarball:
@@ -280,7 +280,7 @@ jobs:
             --draft \
             releases/$VERSION/*
         env:
-          GH_TOKEN: ${{ secrets.RTX_GITHUB_BOT_TOKEN }}
+          GH_TOKEN: ${{ secrets.MISE_GH_TOKEN }}
       - name: Publish Release Assets to CDN
         if: startsWith(github.event.ref, 'refs/tags/v')
         run: mise x -- scripts/publish-release.sh
@@ -294,4 +294,4 @@ jobs:
           VERSION="$(./scripts/get-version.sh)"
           gh release edit "$VERSION" --draft=false
         env:
-          GH_TOKEN: ${{ secrets.RTX_GITHUB_BOT_TOKEN }}
+          GH_TOKEN: ${{ secrets.MISE_GH_TOKEN }}

.github/workflows/test-plugins.yml

@@ -17,7 +17,7 @@ on:
 
 env:
   CARGO_TERM_COLOR: always
-  GITHUB_API_TOKEN: ${{ secrets.MY_RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
+  GITHUB_API_TOKEN: ${{ secrets.MISE_GH_TOKEN || secrets.GITHUB_TOKEN }}
 
 jobs:
   build-linux:

.github/workflows/test-vfox.yml

@@ -17,7 +17,7 @@ env:
   MISE_EXPERIMENTAL: 1
   MISE_LOCKFILE: 1
   RUST_BACKTRACE: 1
-  GITHUB_TOKEN: ${{ secrets.MY_RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
+  GITHUB_TOKEN: ${{ secrets.MISE_GH_TOKEN || secrets.GITHUB_TOKEN }}
 
 jobs:
   "test-vfox":

.github/workflows/test.yml

@@ -18,7 +18,7 @@ env:
   MISE_EXPERIMENTAL: 1
   MISE_LOCKFILE: 1
   RUST_BACKTRACE: 1
-  GITHUB_TOKEN: ${{ secrets.MY_RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
+  GITHUB_TOKEN: ${{ secrets.MISE_GH_TOKEN || secrets.GITHUB_TOKEN }}
 
 permissions:
   pull-requests: write

.github/workflows/winget.yml

@@ -10,7 +10,7 @@ jobs:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         with:
           repository: jdx/winget-pkgs
-          token: ${{ secrets.RTX_GITHUB_BOT_TOKEN }}
+          token: ${{ secrets.MISE_GH_TOKEN }}
           fetch-depth: 0
       - run: git config user.name mise-en-dev
       - run: git config user.email release@mise.jdx.dev
@@ -21,4 +21,4 @@ jobs:
         with:
           identifier: jdx.mise
           max-versions-to-keep: 5
-          token: ${{ secrets.RTX_GITHUB_BOT_TOKEN }}
+          token: ${{ secrets.MISE_GH_TOKEN }}

xtasks/test/coverage

@@ -3,10 +3,6 @@
 
 echo "::group::Setup"
 set -euxo pipefail
-# shellcheck disable=SC1090
-if [[ -n ${MISE_GITHUB_BOT_TOKEN:-} ]]; then
-	export GITHUB_API_TOKEN="$MISE_GITHUB_BOT_TOKEN"
-fi
 export CARGO_TARGET_DIR="${CARGO_TARGET_DIR:-$PWD/target}"
 export PATH="${CARGO_TARGET_DIR}/debug:$PATH"