From 89ca5aedb0cd6bff15bd379470adc4cafc6bc8c3 Mon Sep 17 00:00:00 2001 From: Jimmy Song Date: Fri, 14 Aug 2026 13:56:14 -0700 Subject: [PATCH] ci(release): sign changesets commits via github-api commit mode `main` enforces a required-signatures ruleset, but changesets/action defaults to `commitMode: git-cli`, which produces unsigned commits, so every Version Packages PR is unmergeable until its commit is re-signed by hand. `github-api` mode routes commits and tags through the GitHub API, which signs them with GitHub's key and attributes them to the owner of GITHUB_TOKEN. Also narrows the job's `write-all` to the permissions it actually uses: contents and pull-requests for the release PR and tags, id-token for npm provenance. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/release.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5751593..adf691e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -13,7 +13,10 @@ permissions: jobs: release: - permissions: write-all + permissions: + contents: write + pull-requests: write + id-token: write name: Release runs-on: ubuntu-latest environment: production @@ -34,6 +37,8 @@ jobs: uses: changesets/action@v1 with: publish: npm run release + # `main` requires signed commits; github-api mode signs with GitHub's key + commitMode: github-api env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} NPM_CONFIG_PROVENANCE: true