From 37314c43b684c3bf0a74b5ac0365f6e1cad495e7 Mon Sep 17 00:00:00 2001 From: Devesh-Skyflow Date: Fri, 24 Jul 2026 16:07:33 +0530 Subject: [PATCH] SK-2986 use admin service-account PAT for release version-bump push (v1) Same fix as #371 (main) / #372 (v3), applied to the v1 branch's copy of shared-build-and-deploy.yml. The v1 release pipeline (release-v1.yml) pushes the version-bump commit directly to the protected v1 branch (git push origin HEAD:v1) as github-actions[bot], which is not a ruleset bypass actor, so the push would be rejected. Point the release checkout at PAT_ACTIONS (skyflow-service-it, a repo admin) so its credential is persisted and reused for the push, which then satisfies the ruleset's repo-admin bypass. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/shared-build-and-deploy.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/shared-build-and-deploy.yml b/.github/workflows/shared-build-and-deploy.yml index 8db92b09..8c75646d 100644 --- a/.github/workflows/shared-build-and-deploy.yml +++ b/.github/workflows/shared-build-and-deploy.yml @@ -48,6 +48,11 @@ jobs: with: ref: ${{ inputs.ref }} fetch-depth: 0 + # PAT of the skyflow-service-it admin service account. Persisted by + # checkout and reused for the automated version-bump push below, so + # that push satisfies the branch-protection ruleset's repo-admin + # bypass (github-actions[bot] is not a bypass actor). See SK-2986. + token: ${{ secrets.PAT_ACTIONS }} - name: Set up maven or jfrog repository uses: actions/setup-java@v4