ci: update release with secret and target repo (#1081)

Author: fadi-george

.github/workflows/create-release-pr.yml

@@ -3,6 +3,10 @@ name: Create Release PR
 on:
   # For making a release pr from android / ios sdk actions
   workflow_call:
+    secrets:
+      GH_PUSH_TOKEN:
+        required: false
+        description: "GitHub token for pushing changes"
     inputs:
       flutter_version:
         description: "New Flutter SDK Version (e.g., 5.3.4 or 5.3.4-beta.1)"
@@ -22,7 +26,7 @@ on:
         type: string
         default: main
 
-  # For making a release pr from cordova github actions
+  # For making a release pr from the github actions
   workflow_dispatch:
     inputs:
       flutter_version:
@@ -46,22 +50,30 @@ on:
 jobs:
   prep:
     uses: OneSignal/sdk-actions/.github/workflows/prep-release.yml@main
+    secrets:
+      # Need this cross-repo token (sdk-actions & this repo) to perform changes
+      GH_PUSH_TOKEN: ${{ secrets.GH_PUSH_TOKEN }}
     with:
+      # Need target_repo otherwise caller would set github.repository to the caller itself (e.g. sdk-actions)
+      target_repo: OneSignal/OneSignal-Flutter-SDK
       version: ${{ inputs.flutter_version }}
 
-  update-version:
+  update_version:
     needs: prep
     runs-on: macos-latest
     outputs:
-      flutter_from: ${{ steps.current_versions.outputs.cordova_from }}
+      flutter_from: ${{ steps.current_versions.outputs.flutter_from }}
       android_from: ${{ steps.current_versions.outputs.android_from }}
       ios_from: ${{ steps.current_versions.outputs.ios_from }}
 
     steps:
       - name: Checkout
         uses: actions/checkout@v5
         with:
+          # Need repository otherwise caller would set github.repository to the caller itself (e.g. sdk-actions)
+          repository: OneSignal/OneSignal-Flutter-SDK
           ref: ${{ needs.prep.outputs.release_branch }}
+          token: ${{ secrets.GH_PUSH_TOKEN || github.token }}
 
       - name: Get current native SDK versions
         id: current_versions
@@ -152,12 +164,17 @@ jobs:
           git push
 
   create-pr:
-    needs: [prep, update-version]
+    needs: [prep, update_version]
     uses: OneSignal/sdk-actions/.github/workflows/create-release.yml@main
+    secrets:
+      # Need this cross-repo token (sdk-actions & this repo) to perform changes
+      GH_PUSH_TOKEN: ${{ secrets.GH_PUSH_TOKEN }}
     with:
+      # Need target_repo otherwise caller would set github.repository to the caller itself (e.g. sdk-actions)
+      target_repo: OneSignal/OneSignal-Flutter-SDK
       release_branch: ${{ needs.prep.outputs.release_branch }}
       target_branch: ${{ inputs.target_branch }}
-      android_from: ${{ needs.update-version.outputs.android_from }}
+      android_from: ${{ needs.update_version.outputs.android_from }}
       android_to: ${{ inputs.android_version }}
-      ios_from: ${{ needs.update-version.outputs.ios_from }}
+      ios_from: ${{ needs.update_version.outputs.ios_from }}
       ios_to: ${{ inputs.ios_version }}