ci(release-please): authenticate with the org's release-please App - #26
Merged
Conversation
Falls back to the existing PAT until the App resolves here, and warns when it does.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Switches release-please to the org's
release-please-managerGitHub App instead of a personal access token.Why: the App token is minted per run and expires in an hour, and it belongs to the org rather than to whoever created the PAT — a PAT dies with its owner's access and takes every repo's releases with it. The App carries
actions: write, which is the permission that matters here: tags pushed with the defaultGITHUB_TOKENdo not trigger workflows, so releases would be tagged and never built.Safe to merge now.
continue-on-erroron the token step plus a||fallback means this keeps using the existing PAT until the App is installed on this repo andRP_APP_ID/RP_APP_PRIVATE_KEYresolve. A "Which credential" step logs a warning annotation whenever the fallback is taken, so the state is never silently wrong. Nothing else in the workflow changes.🤖 Generated with Claude Code