From a515f4ab5573bd377726ed752742153beadd39ca Mon Sep 17 00:00:00 2001 From: Robby Thompson Date: Thu, 24 Sep 2026 11:23:52 -0500 Subject: [PATCH] ci: commit and tag with a GitHub App token that can bypass main ruleset The default GITHUB_TOKEN (github-actions[bot]) cannot be added to the main branch ruleset's bypass list, so its createCommitOnBranch call is rejected by the required status checks. Mint a token from a GitHub App that is on the bypass list and use it for the version-bump commit and the release tag. Requires repo secrets RELEASE_APP_ID and RELEASE_APP_PRIVATE_KEY, and the App added to the main ruleset bypass list. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/release.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index cca2a7f..4c0c576 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -22,6 +22,13 @@ jobs: - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: { cache: yarn, node-version-file: .node-version } + - name: Mint release token + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + app-id: ${{ secrets.RELEASE_APP_ID }} + private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} + - name: Ensure release runs from main run: | if [ "${{ github.ref }}" != "refs/heads/main" ]; then @@ -63,6 +70,7 @@ jobs: VERSION: ${{ steps.bump.outputs.version }} VERSION_FILES: ${{ steps.bump.outputs.files }} with: + github-token: ${{ steps.app-token.outputs.token }} script: | const fs = require('fs') @@ -146,6 +154,7 @@ jobs: COMMIT_SHA: ${{ steps.commit.outputs.sha }} VERSION_TAG: ${{ steps.bump.outputs.tag }} with: + github-token: ${{ steps.app-token.outputs.token }} script: | const { owner, repo } = context.repo const tag = process.env.VERSION_TAG