Skip to content

ci: open the release pull request as the app so it gets CI #2403

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
alexander-akait wants to merge 2 commits into from
+23 −3
Closed

ci: open the release pull request as the app so it gets CI #2403

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
856c4f2
ci: open the release pull request as the app so it gets CI
alexander-akait Sep 2, 2026
9023411
ci: narrow the release app token to the permissions it needs
alexander-akait Sep 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 23 additions & 3 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,22 @@ jobs:
outputs:
published: ${{ steps.changesets.outputs.published }}
steps:
# A pull request opened with the repository's own GITHUB_TOKEN does not
# trigger workflows, so the release pull request never gets CI and sits
# with no checks reported. Opening it as the app makes the tests, lint
# and client jobs run on the version bump before it is merged.
- name: Generate Token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
Comment thread
coderabbitai[bot] marked this conversation as resolved.
id: app-token
with:
app-id: ${{ secrets.BOT_APP_ID }}
private-key: ${{ secrets.BOT_PRIVATE_KEY }}
# Without these the token carries every permission the app is
# installed with. These two are what changesets/action documents it
# needs: commit the version change, and open the pull request.
permission-contents: write
permission-pull-requests: write

- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Use Node.js
Expand All @@ -34,12 +50,16 @@ jobs:
id: changesets
uses: changesets/action@8488615a623b1b9c987934bb89eae8af6a946ac1 # v2.1.1
with:
# v2 takes a custom token through this input; the GITHUB_TOKEN
# environment variable is no longer read for the action's own auth.
github-token: ${{ steps.app-token.outputs.token }}
version-script: npm run version
publish-script: npm run release
commit-message: "chore(release): new release"
pr-title: "chore(release): new release"
env:
# v2 no longer reads this for its own auth, but `changeset version`
# runs the changelog generator, which needs it to query GitHub.
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# Still needed as an environment variable: `changeset version` runs
# the changelog generator, which queries GitHub for commit and pull
# request info.
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
NPM_TOKEN: "" # https://github.com/changesets/changesets/issues/1152#issuecomment-3190884868