From 291ead079a46fb2f6a5b5115897c862bb8aab7f5 Mon Sep 17 00:00:00 2001
From: Vitaly Turovsky <vital2580@icloud.com>
Date: Sat, 29 Mar 2025 11:13:33 +0300
Subject: [PATCH] use token: workaround

---
 .github/workflows/ci.yml | 76 +++++++++++++++++++++++++---------------
 1 file changed, 48 insertions(+), 28 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dc1deee5..d44c45f7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,7 +4,9 @@ on:
 jobs:
   build-and-deploy:
     runs-on: ubuntu-latest
-    permissions: write-all
+    permissions:
+      contents: write
+      gists: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@master
@@ -36,6 +38,40 @@ jobs:
       - run: pnpm build-storybook
       - run: pnpm test-unit
       - run: pnpm lint
+
+      - name: Parse Bundle Stats
+        run: |
+          GZIP_BYTES=$(du -s self-host.zip 2>/dev/null | cut -f1)
+          SIZE=$(echo "scale=2; $SIZE_BYTES/1024/1024" | bc)
+          GZIP_SIZE=$(echo "scale=2; $GZIP_BYTES/1024/1024" | bc)
+          echo "{\"total\": ${SIZE}, \"gzipped\": ${GZIP_SIZE}}" > /tmp/bundle-stats.json
+
+      - name: Compare Bundle Stats
+        id: compare
+        uses: actions/github-script@v6
+        env:
+          GIST_TOKEN: ${{ secrets.GIST_TOKEN }}
+        with:
+          script: |
+            const gistId = '${{ secrets.BUNDLE_STATS_GIST_ID }}';
+
+            async function getGistContent() {
+              const { data } = await github.rest.gists.get({
+                gist_id: gistId,
+                headers: {
+                  authorization: `token ${process.env.GIST_TOKEN}`
+                }
+              });
+              return JSON.parse(data.files['bundle-stats.json'].content || '{}');
+            }
+
+            const content = await getGistContent();
+            const baseStats = content['${{ github.event.pull_request.base.ref }}'];
+            const newStats = require('/tmp/bundle-stats.json');
+
+            const comparison = `minecraft.html (normal build gzip)\n${baseStats.total}MB (${baseStats.gzipped}MB compressed) -> ${newStats.total}MB (${newStats.gzipped}MB compressed)`;
+            core.setOutput('stats', comparison);
+
       # - run: pnpm tsx scripts/buildNpmReact.ts
       - run: nohup pnpm prod-start &
       - run: nohup pnpm test-mc-server &
@@ -52,47 +88,31 @@ jobs:
       #   env:
       #     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Parse Bundle Stats
-        run: |
-          GZIP_BYTES=$(du -s self-host.zip 2>/dev/null | cut -f1)
-          SIZE=$(echo "scale=2; $SIZE_BYTES/1024/1024" | bc)
-          GZIP_SIZE=$(echo "scale=2; $GZIP_BYTES/1024/1024" | bc)
-          echo "{\"total\": ${SIZE}, \"gzipped\": ${GZIP_SIZE}}" > /tmp/bundle-stats.json
-
-      - name: Compare Bundle Stats
-        id: compare
-        uses: actions/github-script@v6
-        with:
-          script: |
-            const gistId = '${{ secrets.BUNDLE_STATS_GIST_ID }}';
-
-            async function getGistContent() {
-              const { data } = await github.rest.gists.get({ gist_id: gistId });
-              return JSON.parse(data.files['bundle-stats.json'].content || '{}');
-            }
-
-            const content = await getGistContent();
-            const baseStats = content['${{ github.event.pull_request.base.ref }}'];
-            const newStats = require('/tmp/bundle-stats.json');
-
-            const comparison = `minecraft.html (normal build gzip)\n${baseStats.total}MB (${baseStats.gzipped}MB compressed) -> ${newStats.total}MB (${newStats.gzipped}MB compressed)`;
-            core.setOutput('stats', comparison);
-
       - name: Store Bundle Stats
         if: github.event.pull_request.base.ref == 'next'
         uses: actions/github-script@v6
+        env:
+          GIST_TOKEN: ${{ secrets.GIST_TOKEN }}
         with:
           script: |
             const gistId = '${{ secrets.BUNDLE_STATS_GIST_ID }}';
 
             async function getGistContent() {
-              const { data } = await github.rest.gists.get({ gist_id: gistId });
+              const { data } = await github.rest.gists.get({
+                gist_id: gistId,
+                headers: {
+                  authorization: `token ${process.env.GIST_TOKEN}`
+                }
+              });
               return JSON.parse(data.files['bundle-stats.json'].content || '{}');
             }
 
             async function updateGistContent(content) {
               await github.rest.gists.update({
                 gist_id: gistId,
+                headers: {
+                  authorization: `token ${process.env.GIST_TOKEN}`
+                },
                 files: {
                   'bundle-stats.json': {
                     content: JSON.stringify(content, null, 2)