From b5ab2a5a3e3646ad09dfda5e5349d26482b98425 Mon Sep 17 00:00:00 2001 From: Joseph Mearman Date: Tue, 1 Sep 2026 16:47:43 +0100 Subject: [PATCH] ci: use the org-wide exadev App token for the release-commit push main's ruleset now requires every change to land via a pull request, which blocks @semantic-release/git's own direct push of the version-bump commit -- the default GITHUB_TOKEN has no bypass for that rule. Generates an installation token from the exadev GitHub App (already installed with access to every ExaDev repo, and added as an Integration bypass_actor on this repo's ruleset) and uses it for checkout's git credentials instead, so only the push itself is elevated; every other API call in the job keeps using GITHUB_TOKEN unchanged. --- .github/workflows/ci.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c851472..3071149 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -190,12 +190,18 @@ jobs: published: ${{ steps.before.outputs.version != steps.after.outputs.version }} version: ${{ steps.after.outputs.version }} steps: - # Internal/semantic-release-workspace's own release job needs a GitHub App token here because main requires status checks to merge there, and the default GITHUB_TOKEN has no bypass for that -- @semantic-release/git's release-commit push is a direct push to main, so it needs an actor the branch ruleset explicitly allows through. Confirmed directly (gh api repos/ExaDev/trilean/branches/main/protection -> "Branch not protected", zero repo-level rulesets) that this repo has no such protection, so there is nothing for GITHUB_TOKEN to be blocked by -- using it here avoids depending on a secret (AUTOMERGE_APP_PRIVATE_KEY) that was never configured for this repo. If main later gains required-status-check protection matching the other repos' convention, this push will start failing the same way the App-token version was built to avoid, and the App-token step will need reinstating. + # main's ruleset requires every change to land via a pull request, and the default GITHUB_TOKEN has no bypass for that -- @semantic-release/git's release-commit push is a direct push to main, so it needs a token from an actor the ruleset explicitly allows through instead. The org-wide "exadev" GitHub App (installed with access to every ExaDev repo, unlike the documents.js-family repos' own narrower, selected-repository app) is that actor, added as an Integration bypass_actor on this repo's ruleset. + - name: Generate a token for the release push + id: app-token + uses: actions/create-github-app-token@v2 + with: + app-id: ${{ secrets.GH_APP_ID }} + private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} - uses: actions/checkout@v7 with: # semantic-release analyses the full commit history since the last release. fetch-depth: 0 - token: ${{ secrets.GITHUB_TOKEN }} + token: ${{ steps.app-token.outputs.token }} - uses: pnpm/action-setup@v6 - uses: actions/setup-node@v7 with: