From b8dcc238e6a2181eb7e6758d007fe56ca8260a97 Mon Sep 17 00:00:00 2001 From: Benedikt Reiser Date: Thu, 23 Jul 2026 11:48:47 +0200 Subject: [PATCH 1/2] ci: release via shared semantic-release workflow with bypass token The default GITHUB_TOKEN cannot push the @semantic-release/git version commit to the protected main branch (GH006, requires PR). Delegate to Innoactive/Portal-Backend's reusable semantic-release workflow, authenticated with a repo-scoped SEMANTIC_RELEASE_GH_TOKEN whose identity bypasses PR protection on main. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release.yml | 33 ++++++++++++--------------------- 1 file changed, 12 insertions(+), 21 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9b8923b..8cd5829 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -7,24 +7,15 @@ on: jobs: release: - name: Release - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v7 - - name: Setup python version - uses: actions/setup-python@v7 - with: - python-version: "3.12" - - name: Install uv - uses: astral-sh/setup-uv@v7 - - name: Install dependecies - run: uv sync --locked - - name: Semantic Release - uses: cycjimmy/semantic-release-action@v6 - with: - extra_plugins: | - @semantic-release/exec - @semantic-release/git - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + name: Semantic Release + # Shared org workflow: checks out this repo, runs semantic-release with the + # SEMANTIC_RELEASE_GH_TOKEN, whose identity is on main's branch-protection + # bypass list — so the @semantic-release/git push to the protected main + # branch is accepted (the default GITHUB_TOKEN is not allowed to bypass). + uses: Innoactive/Portal-Backend/.github/workflows/semantic-release.yml@develop + secrets: + gh_token: ${{ secrets.SEMANTIC_RELEASE_GH_TOKEN }} + with: + extra-semantic-release-plugins: | + @semantic-release/exec + @semantic-release/git From bbe058eff6ac47a54b12d5e0adaf29a52c29a497 Mon Sep 17 00:00:00 2001 From: Benedikt Reiser Date: Thu, 23 Jul 2026 11:58:54 +0200 Subject: [PATCH 2/2] ci: inline semantic-release with bypass token A public repo cannot call the private Portal-Backend reusable workflow, so run semantic-release directly here instead. persist-credentials:false ensures the push to the protected main branch uses SEMANTIC_RELEASE_GH_TOKEN (whose identity is on main's bypass list) rather than the default GITHUB_TOKEN. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release.yml | 33 ++++++++++++++++++++++----------- 1 file changed, 22 insertions(+), 11 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8cd5829..6b93c21 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -8,14 +8,25 @@ on: jobs: release: name: Semantic Release - # Shared org workflow: checks out this repo, runs semantic-release with the - # SEMANTIC_RELEASE_GH_TOKEN, whose identity is on main's branch-protection - # bypass list — so the @semantic-release/git push to the protected main - # branch is accepted (the default GITHUB_TOKEN is not allowed to bypass). - uses: Innoactive/Portal-Backend/.github/workflows/semantic-release.yml@develop - secrets: - gh_token: ${{ secrets.SEMANTIC_RELEASE_GH_TOKEN }} - with: - extra-semantic-release-plugins: | - @semantic-release/exec - @semantic-release/git + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v7 + with: + # Full history + tags so semantic-release can determine the next version. + fetch-depth: 0 + # Must be false: otherwise checkout stores the default GITHUB_TOKEN as a git + # auth header and the release push would use it (github-actions[bot], which is + # NOT on main's bypass list → GH006). With no persisted credentials, the push + # uses the SEMANTIC_RELEASE_GH_TOKEN below instead. + persist-credentials: false + - name: Semantic Release + uses: cycjimmy/semantic-release-action@v6 + with: + extra_plugins: | + @semantic-release/exec + @semantic-release/git + env: + # Repo-scoped token whose identity bypasses PR protection on main, so the + # @semantic-release/git version-bump commit can be pushed to the protected branch. + GITHUB_TOKEN: ${{ secrets.SEMANTIC_RELEASE_GH_TOKEN }}