From 0bfbce75dc55bce1df8326ab826176e20e92c3dc Mon Sep 17 00:00:00 2001 From: Joseph Mearman Date: Sat, 12 Sep 2026 13:29:13 +0100 Subject: [PATCH] fix(ci): rewrite release pushes to SSH so the deploy key actually authenticates actions/checkout's ssh-key input only wires the deploy key into core.sshCommand for its own git operations -- it never rewrites the "origin" remote or any later command's push URL. @semantic-release/git builds its push against a plain https://github.com/... URL, which the still-active default-token credential (persist-credentials) satisfied instead of the deploy key, so the previous fix never actually used SSH and the release push kept failing identically. Disabling persist-credentials and adding a global insteadOf rewrite for every https://github.com/ URL makes semantic-release's hardcoded push go out over SSH, where GitHub attributes it to the deploy key and the ruleset's DeployKey bypass actually applies. --- .github/workflows/ci.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b1b942f..bf4b362 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -94,6 +94,9 @@ jobs: # semantic-release analyses the full commit history since the last release. fetch-depth: 0 ssh-key: ${{ secrets.RELEASE_DEPLOY_KEY }} + # ssh-key only wires the deploy key into core.sshCommand for actions/checkout's own git commands -- it does not rewrite the "origin" remote or any later command's push URL. @semantic-release/git constructs its push against a plain https://github.com/... URL, which persist-credentials would otherwise satisfy with the default GITHUB_TOKEN instead of the deploy key, so that credential is turned off and every https://github.com/ URL is rewritten to the SSH form the deploy key actually authenticates. + persist-credentials: false + - run: git config --global url."git@github.com:".insteadOf "https://github.com/" - uses: pnpm/action-setup@v6 - uses: actions/setup-node@v7 with: