From ad255415e76e9716e3ba0463dc9e4c20f299f499 Mon Sep 17 00:00:00 2001 From: Devesh-Skyflow Date: Fri, 24 Jul 2026 09:05:12 +0530 Subject: [PATCH] SK-2986 use admin service-account PAT for release version-bump push Branch protection now enforces PR+approval on main/v1/v3. The automated version-bump commit pushes directly to the release branch as github-actions[bot], which is not a ruleset bypass actor, so the push would be rejected. Point the release checkout at PAT_ACTIONS (skyflow-service-it, a repo admin) so its credential is persisted and reused for the push, which then satisfies the ruleset's repo-admin bypass. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/shared-build-and-deploy.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/shared-build-and-deploy.yml b/.github/workflows/shared-build-and-deploy.yml index 29fa4b2d..59c35767 100644 --- a/.github/workflows/shared-build-and-deploy.yml +++ b/.github/workflows/shared-build-and-deploy.yml @@ -50,6 +50,11 @@ jobs: - uses: actions/checkout@v2 with: fetch-depth: 0 + # PAT of the skyflow-service-it admin service account. Persisted by + # checkout and reused for the automated version-bump push below, so + # that push satisfies the branch-protection ruleset's repo-admin + # bypass (github-actions[bot] is not a bypass actor). See SK-2986. + token: ${{ secrets.PAT_ACTIONS }} - name: Set up maven or jfrog repository uses: actions/setup-java@v4