feat(ci): use a GitHub App token for release-please (App -> PAT -> GITHUB_TOKEN)#83
Merged
Merged
Conversation
…GITHUB_TOKEN) Prefer a short-lived GitHub App installation token to author the release tag so it triggers the tag-driven release.yml (PyPI + Docker) — like a PAT, unlike GITHUB_TOKEN, but auto-minted, nothing to rotate, and tied to no personal account (and reusable across org repos via org-level App secrets). - release-please.yml: add an actions/create-github-app-token step gated on the `RELEASE_PLEASE_APP_ID` Actions *variable* (App IDs aren't sensitive and vars are usable in `if:`), with the private key in the `RELEASE_PLEASE_APP_KEY` secret. Token precedence: App token -> RELEASE_PLEASE_TOKEN PAT -> GITHUB_TOKEN. Degrades gracefully when the App isn't configured (step skipped). - CONTRIBUTING.md: document the three-tier token resolution + App setup. actionlint clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HAPB5GA4NVUgKFsVFVJDxN
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Switch release-please to author its release tag with a short-lived GitHub App installation token so the tag triggers
release.yml(PyPI + Docker) — the best-hygiene alternative to a personal PAT for an org: auto-minted, nothing to rotate, tied to no human account, and reusable across org repos.Token precedence in
release-please.yml(each degrades gracefully to the next):actions/create-github-app-token, gated on theRELEASE_PLEASE_APP_IDvariable being set)RELEASE_PLEASE_TOKENPATGITHUB_TOKEN(release PRs still open; tag just won't auto-publish)The App ID is stored as an Actions variable (not sensitive, and usable in
if:); the private key is theRELEASE_PLEASE_APP_KEYsecret.Manual setup required (repo/org admin)
get2knowio/remo(and any other repos later)..pem).RELEASE_PLEASE_APP_ID= the App's numeric IDRELEASE_PLEASE_APP_KEY= the full contents of the.pemUntil those are set, release-please falls back to PAT/
GITHUB_TOKEN(unchanged behavior).Notes
actionlintclean.actions/create-github-app-token@v2andgoogleapis/release-please-action@v4are floating tags (SHAs unresolvable offline) — pin to@<sha>to match repo convention.🤖 Generated with Claude Code