External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

ci(release): authenticate main pushes with an admin RELEASE_TOKEN (#486)

Browse Source 
Point semantic-release's version-bump push and the docs-changelog push at a RELEASE_TOKEN admin PAT so they clear the 16 required checks (default token is rejected). Falls back to the default token, so no change until the secret is set. Documents creating/rotating the token in RELEASE.md.
This commit is contained in:
SnapOtter
2026-07-11 12:49:02 +08:00
committed by GitHub
parent 4a5a6718e6
commit 2e91368816
2 changed files with 31 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/release.yml
+13 -4
View File
@@ -37,7 +37,12 @@ jobs:
- name: Run semantic-release
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# RELEASE_TOKEN is a fine-grained PAT (repo Contents/Issues/PRs: write)
# owned by an admin, so semantic-release's push of the chore(release)
# commit + tag clears branch protection (enforce_admins is off). Falls
# back to the default token if the secret is unset, so behaviour is
# unchanged until the secret exists.
GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
run: npx semantic-release
- name: Check for new release
@@ -72,7 +77,7 @@ jobs:
- name: Update docs changelog
if: steps.notes.outputs.has_notes == 'true' && steps.check.outputs.version
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
VERSION: ${{ steps.check.outputs.version }}
run: |
CHANGELOG="apps/docs/changelog.md"
@@ -100,8 +105,12 @@ jobs:
git config user.name "SnapOtter"
git config user.email "snapotter.hq@gmail.com"
git add "$CHANGELOG"
git commit -m "docs: update changelog for v${VERSION}" || true
git push origin HEAD:main || true
git commit -m "docs: update changelog for v${VERSION} [skip ci]" || true
# Authenticate this direct push explicitly: the job's checkout uses
# persist-credentials: false, so there is no ambient credential. The
# PAT's admin identity bypasses branch protection; if the secret is
# unset this no-ops (|| true) exactly as before.
git push "https://x-access-token:${RELEASE_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" HEAD:main || true
echo "Docs changelog updated for v${VERSION}."
prebuilt: