From b12e2e39e96e2b4194f384cb658d9dd5232c4234 Mon Sep 17 00:00:00 2001
From: Ogulcan Celik <ogulcancelik@gmail.com>
Date: Mon, 25 May 2026 17:07:10 +0300
Subject: [PATCH] ci: use kangal bot for contributor approval workflows

---
 .github/workflows/approve-contributor.yml        | 14 +++++++++-----
 .github/workflows/approve-merged-contributor.yml | 13 ++++++++-----
 2 files changed, 17 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/approve-contributor.yml b/.github/workflows/approve-contributor.yml
index bc68b4f0..ee1ee91a 100644
--- a/.github/workflows/approve-contributor.yml
+++ b/.github/workflows/approve-contributor.yml
@@ -9,18 +9,19 @@ jobs:
     if: ${{ !github.event.issue.pull_request }}
     runs-on: ubuntu-latest
     permissions:
-      contents: write
-      issues: write
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.repository.default_branch }}
+          persist-credentials: false
 
       - name: Add contributor to approved list
         id: update
         uses: actions/github-script@v9
         with:
+          github-token: ${{ secrets.KANGAL_GITHUB_TOKEN }}
           script: |
             const fs = require('fs');
 
@@ -79,17 +80,20 @@ jobs:
 
       - name: Commit and push
         if: steps.update.outputs.status == 'added'
+        env:
+          KANGAL_GITHUB_TOKEN: ${{ secrets.KANGAL_GITHUB_TOKEN }}
         run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git config user.name "kangal-bot"
+          git config user.email "285672167+kangal-bot@users.noreply.github.com"
           git add .github/APPROVED_CONTRIBUTORS
           git diff --staged --quiet || git commit -m "chore: approve contributor ${{ github.event.issue.user.login }}"
-          git push
+          git push "https://x-access-token:${KANGAL_GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" HEAD:${{ github.event.repository.default_branch }}
 
       - name: Comment on issue
         if: steps.update.outputs.status == 'added'
         uses: actions/github-script@v9
         with:
+          github-token: ${{ secrets.KANGAL_GITHUB_TOKEN }}
           script: |
             const issueAuthor = context.payload.issue.user.login;
             await github.rest.issues.createComment({
diff --git a/.github/workflows/approve-merged-contributor.yml b/.github/workflows/approve-merged-contributor.yml
index 7885172d..deeb8936 100644
--- a/.github/workflows/approve-merged-contributor.yml
+++ b/.github/workflows/approve-merged-contributor.yml
@@ -9,18 +9,19 @@ jobs:
     if: ${{ github.event.pull_request.merged == true }}
     runs-on: ubuntu-latest
     permissions:
-      contents: write
-      pull-requests: read
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.repository.default_branch }}
+          persist-credentials: false
 
       - name: Add merged contributor to approved list
         id: update
         uses: actions/github-script@v9
         with:
+          github-token: ${{ secrets.KANGAL_GITHUB_TOKEN }}
           script: |
             const fs = require('fs');
 
@@ -53,9 +54,11 @@ jobs:
 
       - name: Commit and push
         if: steps.update.outputs.status == 'added'
+        env:
+          KANGAL_GITHUB_TOKEN: ${{ secrets.KANGAL_GITHUB_TOKEN }}
         run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git config user.name "kangal-bot"
+          git config user.email "285672167+kangal-bot@users.noreply.github.com"
           git add .github/APPROVED_CONTRIBUTORS
           git diff --staged --quiet || git commit -m "chore: approve merged contributor ${{ github.event.pull_request.user.login }}"
-          git push
+          git push "https://x-access-token:${KANGAL_GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" HEAD:${{ github.event.repository.default_branch }}