From 3c3e097dcaa99d9d1e959a08cee87e22f0205481 Mon Sep 17 00:00:00 2001
From: Brandon Estrella <onamfc@gmail.com>
Date: Fri, 6 Nov 2026 16:42:22 -0800
Subject: [PATCH] ci: push release and CLA signature commits with the LinkForty
 bot app token

The release workflow and the CLA workflow both commit straight to main: semantic-release pushes the version bump, changelog and tag, and the CLA action records each signature in signatures/cla.json. Once main carries a ruleset that requires a pull request, those pushes need a bypass actor. GitHub refuses to add the workflow's own GITHUB_TOKEN (the GitHub Actions integration) to a ruleset's bypass list on an organization repository, so both workflows now mint an installation token for the organization's GitHub App and push with that. The app is the bypass actor instead.

Requires the LINKFORTY_BOT_APP_ID and LINKFORTY_BOT_PRIVATE_KEY secrets. The CLA workflow no longer reads CLA_ASSISTANT_PAT.
---
 .github/workflows/cla.yml     | 13 ++++++++++++-
 .github/workflows/release.yml | 16 +++++++++++++++-
 2 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
index 72179aa..356249e 100644
--- a/.github/workflows/cla.yml
+++ b/.github/workflows/cla.yml
@@ -21,11 +21,22 @@ jobs:
       (github.event_name == 'pull_request_target') ||
       (github.event_name == 'issue_comment' && github.event.comment.body == 'recheck')
     steps:
+      # The signature commit lands on main directly. main's ruleset only lets
+      # repository admins and the LinkForty bot app bypass the pull-request
+      # requirement, and GitHub does not allow the workflow's own GITHUB_TOKEN
+      # as a bypass actor, so the commit has to be made with the app's token.
+      - name: Mint bot token
+        id: bot
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.LINKFORTY_BOT_APP_ID }}
+          private-key: ${{ secrets.LINKFORTY_BOT_PRIVATE_KEY }}
+
       - name: CLA Assistant
         uses: contributor-assistant/github-action@v2.6.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PERSONAL_ACCESS_TOKEN: ${{ secrets.CLA_ASSISTANT_PAT }}
+          PERSONAL_ACCESS_TOKEN: ${{ steps.bot.outputs.token }}
         with:
           path-to-document: 'https://github.com/linkforty/core/blob/main/CLA.md'
           # The action defaults this to 'master', which does not exist in this
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d058abc..b7dfc6e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,10 +26,24 @@ jobs:
       id-token: write # For NPM provenance
 
     steps:
+      # semantic-release pushes the release commit and tag straight to main.
+      # main's ruleset only lets repository admins and the LinkForty bot app
+      # bypass the pull-request requirement, and GitHub does not allow the
+      # workflow's own GITHUB_TOKEN as a bypass actor, so the push has to be
+      # made with the app's token. The "[skip ci]" in the release commit
+      # message keeps that push from starting another CI or release run.
+      - name: Mint bot token
+        id: bot
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.LINKFORTY_BOT_APP_ID }}
+          private-key: ${{ secrets.LINKFORTY_BOT_PRIVATE_KEY }}
+
       - name: Checkout code
         uses: actions/checkout@v4
         with:
           fetch-depth: 0 # Fetch all history for semantic-release
+          token: ${{ steps.bot.outputs.token }}
           persist-credentials: false
 
       - name: Setup Node.js
@@ -49,7 +63,7 @@ jobs:
 
       - name: Release
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.bot.outputs.token }}
         run: npx semantic-release
 
   # Notify on failure