From 856c4f23f9d8bedab33737d01ed98117fdb7f8b9 Mon Sep 17 00:00:00 2001 From: alexander-akait Date: Wed, 2 Sep 2026 19:10:56 +0000 Subject: [PATCH 1/2] ci: open the release pull request as the app so it gets CI A pull request opened with the repository's own GITHUB_TOKEN does not trigger workflows, so the release pull request never ran lint, the test matrix or the client job -- #2393 has only the two Socket checks on it, and with no checks reported it cannot be merged. The repository already generates an app token for the dependabot auto-merge workflow; the release job now does the same and hands it to changesets/action. v2 takes a custom token through the github-token input rather than the environment variable, which stays set because changeset version runs the changelog generator against the GitHub API. --- .github/workflows/release.yml | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index be5995156..6c72afd72 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -20,6 +20,17 @@ jobs: outputs: published: ${{ steps.changesets.outputs.published }} steps: + # A pull request opened with the repository's own GITHUB_TOKEN does not + # trigger workflows, so the release pull request never gets CI and sits + # with no checks reported. Opening it as the app makes the tests, lint + # and client jobs run on the version bump before it is merged. + - name: Generate Token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + id: app-token + with: + app-id: ${{ secrets.BOT_APP_ID }} + private-key: ${{ secrets.BOT_PRIVATE_KEY }} + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Use Node.js @@ -34,12 +45,16 @@ jobs: id: changesets uses: changesets/action@8488615a623b1b9c987934bb89eae8af6a946ac1 # v2.1.1 with: + # v2 takes a custom token through this input; the GITHUB_TOKEN + # environment variable is no longer read for the action's own auth. + github-token: ${{ steps.app-token.outputs.token }} version-script: npm run version publish-script: npm run release commit-message: "chore(release): new release" pr-title: "chore(release): new release" env: - # v2 no longer reads this for its own auth, but `changeset version` - # runs the changelog generator, which needs it to query GitHub. - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # Still needed as an environment variable: `changeset version` runs + # the changelog generator, which queries GitHub for commit and pull + # request info. + GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} NPM_TOKEN: "" # https://github.com/changesets/changesets/issues/1152#issuecomment-3190884868 From 9023411bc45b884a2ef1d96ba0cd3a35aa8d4d65 Mon Sep 17 00:00:00 2001 From: alexander-akait Date: Wed, 2 Sep 2026 19:19:08 +0000 Subject: [PATCH 2/2] ci: narrow the release app token to the permissions it needs create-github-app-token mints a token carrying every permission the app is installed with. changesets/action documents needing contents: write to commit the version change and pull-requests: write to open the pull request, so the token now requests those two and nothing else. They match the job's own permissions block; id-token comes from the workflow for trusted publishing and is not a token permission. --- .github/workflows/release.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6c72afd72..63347198a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -30,6 +30,11 @@ jobs: with: app-id: ${{ secrets.BOT_APP_ID }} private-key: ${{ secrets.BOT_PRIVATE_KEY }} + # Without these the token carries every permission the app is + # installed with. These two are what changesets/action documents it + # needs: commit the version change, and open the pull request. + permission-contents: write + permission-pull-requests: write - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1