Skip to content

ci: use the org-wide exadev App token for the release-commit push #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Mearman merged 1 commit into from
Sep 1, 2026
Merged

ci: use the org-wide exadev App token for the release-commit push #10

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -190,12 +190,18 @@ jobs:
published: ${{ steps.before.outputs.version != steps.after.outputs.version }}
version: ${{ steps.after.outputs.version }}
steps:
# Internal/semantic-release-workspace's own release job needs a GitHub App token here because main requires status checks to merge there, and the default GITHUB_TOKEN has no bypass for that -- @semantic-release/git's release-commit push is a direct push to main, so it needs an actor the branch ruleset explicitly allows through. Confirmed directly (gh api repos/ExaDev/trilean/branches/main/protection -> "Branch not protected", zero repo-level rulesets) that this repo has no such protection, so there is nothing for GITHUB_TOKEN to be blocked by -- using it here avoids depending on a secret (AUTOMERGE_APP_PRIVATE_KEY) that was never configured for this repo. If main later gains required-status-check protection matching the other repos' convention, this push will start failing the same way the App-token version was built to avoid, and the App-token step will need reinstating.
# main's ruleset requires every change to land via a pull request, and the default GITHUB_TOKEN has no bypass for that -- @semantic-release/git's release-commit push is a direct push to main, so it needs a token from an actor the ruleset explicitly allows through instead. The org-wide "exadev" GitHub App (installed with access to every ExaDev repo, unlike the documents.js-family repos' own narrower, selected-repository app) is that actor, added as an Integration bypass_actor on this repo's ruleset.
- name: Generate a token for the release push
id: app-token
uses: actions/create-github-app-token@v2
with:
app-id: ${{ secrets.GH_APP_ID }}
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
- uses: actions/checkout@v7
with:
# semantic-release analyses the full commit history since the last release.
fetch-depth: 0
token: ${{ secrets.GITHUB_TOKEN }}
token: ${{ steps.app-token.outputs.token }}
- uses: pnpm/action-setup@v6
- uses: actions/setup-node@v7
with:
Expand Down
Loading