fix(release): push the release commit and backmerge with the org App token - #34
Merged
Merged
Conversation
…token The org rulesets that protect develop and main name the org App as their bypass actor. GITHUB_TOKEN is not one, so semantic-release's push of the version commit was rejected (GH013) on every protected branch, and every develop release in the fleet failed from 2026-09-12 to 2026-09-14. The release and backmerge jobs now mint an App installation token from GH_APP_CLIENT_ID / GH_APP_PRIVATE_KEY, already declared as workflow secrets, and push with it. A repo without the secrets falls back to GITHUB_TOKEN with a warning instead of failing, since a repo outside the rulesets still releases that way. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
|
🎉 This PR is included in version 1.6.2 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The
releaseandbackmergejobs in the reusable release workflow now mint an installation token for the org App from the already-declaredGH_APP_CLIENT_ID/GH_APP_PRIVATE_KEYsecrets and push with it. A caller without the secrets falls back toGITHUB_TOKENwith a warning, so a repo outside the org rulesets still releases.Why
The org rulesets that protect
developandmainname the org App as their bypass actor.GITHUB_TOKENis not one and cannot be made one, so semantic-release's push of the version commit was rejected withGH013on every protected branch. Every develop release in the fleet failed that way from 2026-09-12, when the rulesets went live, until this was noticed on 2026-09-14.An App-authored push retriggers workflows where a
GITHUB_TOKENone does not. The release commit and the backmerge commit already carry[skip ci], so no existing caller changes behaviour. The AGENTS.md invariant table records both facts.Verification
actionlintclean with the same ignoresself-testuses.v1moves: dispatchReleaseondevelopin one affected repo and confirm the version commit lands and is pushed by the App; then the rest.mainrelease withbackmerge: trueconfirms the backmerge push too.🤖 Generated with Claude Code