ci(tools): Push exe tools only after merged in master

Author: lucasssvaz

.github/scripts/upload_py_tools.sh

@@ -3,10 +3,17 @@ name: Build Python Tools
 on:
   pull_request:
     paths:
-    - 'tools/get.py'
-    - 'tools/espota.py'
-    - 'tools/gen_esp32part.py'
-    - 'tools/gen_insights_package.py'
+      - 'tools/get.py'
+      - 'tools/espota.py'
+      - 'tools/gen_esp32part.py'
+      - 'tools/gen_insights_package.py'
+  push:
+    branches:
+      - master
+
+concurrency:
+  group: pytools-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 jobs:
   find-changed-tools:
@@ -20,18 +27,17 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 2
-          ref: ${{ github.event.pull_request.head.ref }}
+
       - name: Verify Python Tools Changed
         uses: tj-actions/changed-files@v41
         id: verify-changed-files
         with:
-          fetch_depth: '2'
-          since_last_remote_commit: 'true'
           files: |
             tools/get.py
             tools/espota.py
             tools/gen_esp32part.py
             tools/gen_insights_package.py
+
       - name: List all changed files
         shell: bash
         run: |
@@ -86,29 +92,41 @@ jobs:
           for tool in ${{ env.CHANGED_TOOLS }}; do
             echo "tool $tool was changed"
           done
+
+      - name: Get token
+        if: github.event_name == 'push'
+        uses: actions/create-github-app-token@v1
+        id: get_token
+        with:
+          app-id: ${{ secrets.TOOLS_UPLOAD_APP_ID }}
+          private-key: ${{ secrets.TOOLS_UPLOAD_APP_TOKEN }}
+
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
-          token: ${{ secrets.TOOLS_UPLOAD_PAT }}
-          ref: ${{ github.event.pull_request.head.ref }}
+          token: ${{ steps.get_token.outputs.token || github.token }}
+
       - name: Set up Python 3.8
         # Skip setting python on ARM because of missing compatibility: https://github.com/actions/setup-python/issues/108
         if: matrix.os != 'ARM' && matrix.os != 'ARM64'
-        uses: actions/setup-python@master
+        uses: actions/setup-python@v5
         with:
           python-version: 3.8
+
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
           pip install pyinstaller requests
+
       - name: Build with PyInstaller
         shell: bash
         run: |
           for tool in ${{ env.CHANGED_TOOLS }}; do
             pyinstaller --distpath ./${{ env.DISTPATH }} -F --icon=.github/pytools/espressif.ico tools/$tool.py
           done
+
       - name: Sign binaries
-        if: matrix.os == 'windows-latest' && env.CERTIFICATE != '' && env.CERTIFICATE_PASSWORD != ''
+        if: matrix.os == 'windows-latest' && github.event_name == 'push' && env.CERTIFICATE != ''
         env:
           CERTIFICATE: ${{ secrets.CERTIFICATE }}
           CERTIFICATE_PASSWORD: ${{ secrets.CERTIFICATE_PASSWORD }}
@@ -119,22 +137,33 @@ jobs:
           {
             ./.github/pytools/Sign-File.ps1 -Path ./${{ env.DISTPATH }}/$node.exe
           }
+
       - name: Test binaries
         shell: bash
         run: |
           for tool in ${{ env.CHANGED_TOOLS }}; do
             ./${{ env.DISTPATH }}/$tool${{ matrix.EXTEN }} -h
           done
+
       - name: Push binary to tools
-        if: matrix.os == 'windows-latest'
+        if: matrix.os == 'windows-latest' && github.event_name == 'push'
         env:
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+          GITHUB_TOKEN: ${{ steps.get_token.outputs.token }}
         shell: bash
         run: |
           for tool in ${{ env.CHANGED_TOOLS }}; do
             cp -f ./${{ env.DISTPATH }}/$tool.exe tools/$tool.exe
           done
-          bash .github/scripts/upload_py_tools.sh "${{ env.CHANGED_TOOLS }}"
+
+          echo "Pushing '${{ env.CHANGED_TOOLS }}' as github-actions[bot]"
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          for tool in ${{ env.CHANGED_TOOLS }}; do
+            git add tools/$tool.exe
+          done
+          git commit -m "change(tools): Push generated tools binaries"
+          git push
+
       - name: Archive artifact
         uses: actions/upload-artifact@master
         with: