Repository navigation
chore(release): authenticate Release Please with GitHub App tokens - #172
Conversation
Mint repository-scoped installation tokens in each Release Please job so release PR updates trigger CI. Request contents, issues, and pull requests write permissions and reduce the jobs' GITHUB_TOKEN grants. Preserve the baseline guard, recovery, artifact publication, and npm trusted publishing. Cover token scope and routing in the existing release workflow checks.
francoischalifour
changed the title
albert20260301
left a comment
albert20260301
left a comment
There was a problem hiding this comment.
Both Release Please jobs now use repository-scoped App tokens, with token creation behind the existing baseline guard where needed. Artifact publication and minimum-Bun coverage are unchanged. No blocking findings.
The first post-merge push still needs to prove the App installation and configured credentials can create the release/PR and trigger downstream CI; this review does not establish live authentication.
|
The first post-merge main-push run successfully created, used, and revoked App tokens in both Release Please jobs. The baseline guard also passed. No release PR was needed and publication was skipped. Live authentication is verified; downstream release-PR check triggering still awaits a release-producing change. |
Authenticate both Release Please jobs with short-lived, repository-scoped GitHub App installation tokens, following Data App's workflow. Grant contents, issues, and pull requests write access to those tokens and reduce the jobs'
GITHUB_TOKENpermissions.