From 2922ea777dbb89c283913a6b91fa726745734c4a Mon Sep 17 00:00:00 2001 From: Joseph Mearman Date: Sat, 12 Sep 2026 13:21:07 +0100 Subject: [PATCH] fix(ci): push release commits over SSH using a deploy key The release job's git push to main was rejected once main's own ruleset started requiring a passing "Required Checks" status on every push, including direct ones -- the default GITHUB_TOKEN has no documented way to bypass a repository ruleset. A write-access deploy key, registered as a DeployKey bypass actor on the ruleset, lets actions/checkout authenticate the push over SSH instead, without introducing a GitHub App installation or an org-admin personal token. --- .github/workflows/ci.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e3fea92..b1b942f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -88,10 +88,12 @@ jobs: published: ${{ steps.before.outputs.version != steps.after.outputs.version }} version: ${{ steps.after.outputs.version }} steps: + # main's own ruleset requires the "Required Checks" status and blocks direct pushes, and the default GITHUB_TOKEN has no way to bypass a repository ruleset (GitHub doesn't support naming the github-actions[bot] identity as a bypass actor at all) -- so semantic-release's own release-commit/tag push needs a bypass identity. A deploy key with write access, added as a DeployKey bypass actor on the ruleset, is the lightest-weight one: repo-scoped, no GitHub App installation to manage, no personal/org-admin credential involved. - uses: actions/checkout@v7 with: # semantic-release analyses the full commit history since the last release. fetch-depth: 0 + ssh-key: ${{ secrets.RELEASE_DEPLOY_KEY }} - uses: pnpm/action-setup@v6 - uses: actions/setup-node@v7 with: