From 87c92060132aa567125569d59deb417582e90198 Mon Sep 17 00:00:00 2001 From: Benedikt Reiser Date: Tue, 29 Sep 2026 12:55:50 +0200 Subject: [PATCH] ci: release as the semantic-release-innoactive GitHub App Replaces SEMANTIC_RELEASE_GH_TOKEN, a personal access token, with a token minted from the semantic-release-innoactive GitHub App in the job that uses it, scoped to this repository. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/release.yml | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6b93c21..e66e689 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -18,8 +18,18 @@ jobs: # Must be false: otherwise checkout stores the default GITHUB_TOKEN as a git # auth header and the release push would use it (github-actions[bot], which is # NOT on main's bypass list → GH006). With no persisted credentials, the push - # uses the SEMANTIC_RELEASE_GH_TOKEN below instead. + # uses the app token below instead. persist-credentials: false + - name: Create app token + id: app-token + uses: actions/create-github-app-token@v3 + with: + # the semantic-release-innoactive GitHub App; the token is scoped to this repository + client-id: Iv23li5KyqO4ET5ySTXk + private-key: ${{ secrets.SEMANTIC_RELEASE_APP_PRIVATE_KEY }} + permission-contents: write + permission-issues: write + permission-pull-requests: write - name: Semantic Release uses: cycjimmy/semantic-release-action@v6 with: @@ -27,6 +37,6 @@ jobs: @semantic-release/exec @semantic-release/git env: - # Repo-scoped token whose identity bypasses PR protection on main, so the - # @semantic-release/git version-bump commit can be pushed to the protected branch. - GITHUB_TOKEN: ${{ secrets.SEMANTIC_RELEASE_GH_TOKEN }} + # The app pushes the @semantic-release/git version-bump commit and, unlike + # GITHUB_TOKEN, creates a release that triggers `release` workflows. + GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}