From 359a4c7c2ac476f83a68f42ed0b045cb6880aa8d Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sat, 12 Sep 2026 20:36:45 +0100
Subject: [PATCH] fix(ci): release as the exadev App to bypass the branch
 ruleset

The semantic-release changelog commit-back pushes directly to main,
which the main-protection ruleset refuses for the workflow token
(GH013). Mint an installation token from the org APP_ID/APP_PRIVATE_KEY
secrets with actions/create-github-app-token and use it as GITHUB_TOKEN
for the release step: the exadev App is the ruleset's permitted
bypasser, so the release commit lands without weakening protection.
npm publishing still rides OIDC trusted publishing with NODE_AUTH_TOKEN
blanked.
---
 .github/workflows/ci.yml | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 18f89df..22063ab 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -78,9 +78,19 @@ jobs:
       - name: Install
         run: pnpm install --frozen-lockfile
 
+      # The changelog commit-back pushes directly to main, which the branch ruleset refuses for the workflow token. Mint an installation token for the exadev App (the ruleset's permitted bypasser) instead.
+      - name: Generate ExaDev App token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          owner: ExaDev
+          repositories: cc-peer
+
       - name: Release
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
           # Explicitly blank: OIDC trusted publishing must be the only credential path.
           NODE_AUTH_TOKEN: ""
           HUSKY: "0"