ci: push release tags with the release app token - #85
Merged
Conversation
Tags pushed with the default GITHUB_TOKEN do not trigger other workflows, so the v1.0.1 tag created by auto-tag never fired publish.yml and 1.0.1 was never published to Hex. Bump the tylerbutler/actions pins from c697a81 to ed7d5e5 and pass RELEASE_APP_ID / RELEASE_APP_PRIVATE_KEY to the auto-tag reusable workflow, which gained optional app-token secrets after the old pin. The workflow declares actions: read, so the caller must grant it too.
✅ Deploy Preview for slate-dets canceled.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
v1.0.1was tagged byauto-tag.ymlbut never published to Hex — hex.pm still shows1.0.0as latest. Tags pushed with the defaultGITHUB_TOKENdo not trigger other workflows, so the tag push never firedpublish.yml.(v1.0.0 published only because that tag was pushed manually — auto-tag was creating unprefixed
1.0.0tags at the time, fixed later in #71.)Changes
tylerbutler/actionspins fromc697a81(2026-02-17) toed7d5e5(2026-07-07). The old pin predates optional app-token support, added upstream in feat(auto-tag): support GitHub App tokens via optional secrets actions#8 on 2026-03-01.RELEASE_APP_ID/RELEASE_APP_PRIVATE_KEYto the auto-tag reusable workflow. It generates an app token, checks out with it, and passes it tochangie-auto-tag— so the tag push is authenticated as the app and triggerspublish.yml.actions: readto the caller'spermissions. The reusable workflow declares it, and a called workflow cannot hold permissions the caller did not grant.release.ymlandpr.ymlare pin bumps only — verified input/output compatible withed7d5e5(changie-check:base-sha/head-sha→has-entries/preview/needs-entry/commit-types-found;changie-release:token/pr-title-template/version-files→skipped/version/pr-url/pr-operation).