Repository navigation
ci: push release and CLA signature commits with the LinkForty bot app token - #103
Merged
Merged
Conversation
… token The release workflow and the CLA workflow both commit straight to main: semantic-release pushes the version bump, changelog and tag, and the CLA action records each signature in signatures/cla.json. Once main carries a ruleset that requires a pull request, those pushes need a bypass actor. GitHub refuses to add the workflow's own GITHUB_TOKEN (the GitHub Actions integration) to a ruleset's bypass list on an organization repository, so both workflows now mint an installation token for the organization's GitHub App and push with that. The app is the bypass actor instead. Requires the LINKFORTY_BOT_APP_ID and LINKFORTY_BOT_PRIVATE_KEY secrets. The CLA workflow no longer reads CLA_ASSISTANT_PAT.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
mainis getting a ruleset that requires a pull request and theclaandCI Successchecks. Two workflows push tomaindirectly and need to bypass it:release.yml: semantic-release pushes the version bump,CHANGELOG.mdand the tag.cla.yml: the CLA action records each signature insignatures/cla.json.What changes
linkforty-botGitHub App withactions/create-github-app-token@v2and push with that. The app is the ruleset's bypass actor.release.ymlchecks out and runs semantic-release with the app token. The[skip ci]already in the release commit message keeps that push from starting another CI or release run.cla.ymlpasses the app token asPERSONAL_ACCESS_TOKENand no longer readsCLA_ASSISTANT_PAT.Verification
The
clacheck on this PR runsmain's copy of the workflow (pull_request_target), so the new steps first run on the next PR after this merges, and the release path runs on the merge itself.