github-actions: use ephemeral tokens (#1241)

.github/workflows/addToProject.yml

@@ -5,8 +5,6 @@ on:
     types: [opened, edited, milestoned]
   pull_request_target:
     types: [opened, edited, milestoned]
-env:
-  MY_GITHUB_TOKEN: ${{ secrets.APM_TECH_USER_TOKEN }}
 
 permissions:
   contents: read
@@ -16,17 +14,33 @@ jobs:
     runs-on: ubuntu-latest
     name: Assign milestoned to Project
     steps:
+    - name: Get token
+      id: get_token
+      uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
+      with:
+        app_id: ${{ secrets.OBS_AUTOMATION_APP_ID }}
+        private_key: ${{ secrets.OBS_AUTOMATION_APP_PEM }}
+        permissions: >-
+          {
+            "issues": "read",
+            "organization_projects": "write",
+            "pull_requests": "read"
+          }
     - name: Assign issues with milestones to project
       uses: elastic/[email protected]
       if: github.event.issue && github.event.issue.milestone
       with:
         project: 'https://github.com/orgs/elastic/projects/454'
         project_id: '5882982'
         column_name: 'Planned'
+      env:
+        MY_GITHUB_TOKEN: ${{ steps.get_token.outputs.token }}
     - name: Assign new pull requests to project
       uses: elastic/[email protected]
       if: github.event.action == 'opened' && github.event.pull_request
       with:
         project: 'https://github.com/orgs/elastic/projects/454'
         project_id: '5882982'
         column_name: 'In Progress'
+      env:
+        MY_GITHUB_TOKEN: ${{ steps.get_token.outputs.token }}