Skip to content

fix: Final deploy key solution for automated releases [patch] - #6

Merged
obarlik merged 9 commits into
mainfrom
dev
Aug 20, 2025
Merged

obarlik merged 9 commits into
mainfrom
dev

Conversation

@obarlik

@obarlik obarlik commented Aug 20, 2025

Copy link
Copy Markdown
Member

🔑 Deploy Key Solution - Organization Level

Complete Solution Implemented:

  1. Organization Deploy Keys Enabled
  2. SSH Deploy Key Created & Added
  3. Organization-level Secret Configured
  4. Workflow Updated for SSH Checkout
  5. Branch Protection Restored

🛡️ Security Model:

  • Humans: Must use PR workflow
  • Deploy Key: Can bypass for automated releases
  • Status checks: Still required for all

🎯 Expected Flow:

  1. PR merge → CI/CD Pipeline runs
  2. CI/CD completes → Auto-release triggers
  3. Deploy key checkout → Version bump commit
  4. NPM publication → v1.0.1 release! 🚀

📚 Organization Pattern:

This deploy key solution works for ALL @codechu repositories.


🎭 Final test of complete automated release workflow

- Ready for first release (0.0.0 → 1.0.1)
- All workflows configured and tested
- Branch protection rules established
- Replace wrong release.yml with proper auto-release.yml
- Fix PR merge trigger (was manual release only)
- Update branch target from master to main
- Enable proper automated release on merge
- Change trigger from pull_request[closed] to workflow_run[completed]
- Add CI/CD Pipeline dependency
- Only run on successful CI/CD completion
- Prevents premature release triggers
- Add github-actions app to branch protection exceptions
- Update workflow permissions with actions:read
- Allow automated release commits while keeping human PR requirement
- Maintain security with selective bot exception
- Keep workflow_run trigger (timing fix)
- Keep actions:read permission (bot fix)
- Reject old pull_request trigger from main
- Maintain all improvements
- Enable deploy keys in organization settings
- Add SSH deploy key with write access
- Configure workflow to use deploy key for checkout
- Restore proper branch protection with PR restrictions
- Bot can now push version bumps while humans need PRs
@obarlik
obarlik merged commit b16cb7f into main Aug 20, 2025
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant